VP, Chief Information Security Officer

When you join the growing BILH team, you're not just taking a job, you’re making a difference in people’s lives.

Job Description:

This leadership role directs, develops, and manages the Cyber Security function for the organization, including enterprise strategy, governance, architecture, operations, risk management, compliance, incident response, resilience, vendor risk, and workforce awareness. The role is accountable for protecting clinical, business, research, and administrative systems and information while supporting safe and reliable patient care.

This role defines and drives execution of enterprise cyber security policies, standards, investments, and performance measures across on-premises, cloud, digital health, EHR, ERP, data and analytics, connected medical device, and artificial intelligence environments. The role establishes security and risk requirements for AI technologies and prepares the organization for AI-enabled threats, including deepfake social engineering, automated phishing, prompt injection, data leakage, model manipulation, and unauthorized use of generative AI.

The role drives the use of AI in combating security threats.

As a member of the IT senior leadership team, the role contributes to enterprise IT and business strategy, advises executive leadership and appropriate board committees on material cyber risk, and partners with Privacy, Compliance, Legal, Risk, Internal Audit, Clinical Operations, Clinical Engineering, Data and Analytics, Human Resources, Supply Chain, and other leaders to strengthen enterprise resilience.

Essential Duties & Responsibilities including by not limited to:

• Sets the mission, vision, strategy, operating model, and multi-year roadmap for the Cyber Security function, aligning priorities with enterprise strategy, patient safety, digital transformation, risk appetite, and measurable risk reduction.
• Leads, manages, and develops the Cyber Security function and its capabilities, including security architecture and engineering, identity and access management, security operations, vulnerability management, governance, risk and compliance, third-party risk, incident response, and workforce education.
• Establishes and maintains enterprise cyber security policies, standards, control frameworks, risk assessments, asset inventories, risk registers, exception processes, and performance measures aligned with applicable laws, regulations, contractual obligations, and recognized industry frameworks.
• Provides clear reporting and expert advice to executive leadership and appropriate board committees regarding material cyber risks, emerging threats, regulatory obligations, control effectiveness, incident readiness, investment priorities, and remediation progress.
• Oversees security monitoring, threat intelligence, threat hunting, incident response, digital forensics, crisis coordination, ransomware preparedness, business continuity, disaster recovery, clinical downtime readiness, and post-incident improvement activities.
• Drives identity-first and zero-trust security practices and oversees protection of cloud, SaaS, endpoint, email, network, application, API, data, EHR, ERP, digital health, connected medical device, Internet of Medical Things, and operational technology environments.
• Co-leads enterprise AI governance and establishes security requirements for the acquisition, development, deployment, monitoring, and retirement of AI, generative AI, machine learning, agent, copilot, and AI-enabled technologies.
• Maintains an inventory and risk-based oversight process for AI systems and addresses AI-related threats, including prompt injection, sensitive-data leakage, model theft or manipulation, data poisoning, insecure outputs, excessive agency, shadow AI, deepfakes, and AI-enabled phishing or malware.
• Drives the use of AI in combating security threats.
• Leads cyber security due diligence, contracting requirements, and ongoing monitoring for vendors, business associates, cloud providers, AI providers, software dependencies, strategic partners, and other critical third parties, including concentration, fourth-party, data-use, and continuity risks.
• Partners with Privacy, Compliance, Legal, Risk, Internal Audit, Clinical, Research, Data and Analytics, Clinical Engineering, Supply Chain, and other leaders to embed cyber security and responsible AI controls into procurement, architecture, system development, major implementations, mergers and affiliations, and technology lifecycle decisions.
• Recruits, develops, coaches, and retains a high-performing cyber security team; maintains succession and workforce plans; promotes an enterprise security culture; and builds current capabilities in cloud, identity, AI security, medical device security, incident response, and healthcare cyber risk.

Preferred Leadership Competencies:

Coaching and Developing Others: Providing feedback, instruction, and development guidance to help others excel in their current or future job responsibilities; planning and supporting the development of individual skills and abilities.

Driving Results: Translating strategic priorities into operational reality; aligning communication, accountabilities, resource capabilities, internal processes, and ongoing measurement systems to ensure that strategic priorities yield measurable and sustainable results.

Emotional Intelligence: Establishing and sustaining trusting relationships by accurately perceiving and interpreting one’s own and others’ emotions and behavior in the context of the political environment; leveraging insights to effectively manage one’s own responses and reactions.

Leading Change: Identifying and driving organizational and cultural changes needed to adapt strategically to changing market demands, technology, and internal initiatives; catalyzing new approaches to improve results by transforming organizational culture, systems, or products/services.

Systems Thinking/ Setting Healthcare Business Strategy: Looks beyond the immediate by establishing and committing to a long-term business direction after considering clinical and financial data, resources, market drivers, and organizational values; anticipating and responding to shifts within the market, technology, or policy environment that influence the delivery, management, and financing of healthcare.

Organizational Requirements:

• Maintain strict adherence to the BILH confidentiality policy.
• Incorporate BILH Standards of Behavior and Guiding Principles into daily activities.
• Comply with all BILH Policies.
• Comply with behavioral expectations of the department and BILH.
• Maintain courteous and effective interactions with colleagues and patients.
• Participate in departmental and/or interdepartmental quality improvement activities. 
• Participate in and successfully complete Mandatory Education.
• Perform all other duties as needed or directed to meet the needs of the department.

Minimum Qualifications:

Education:

Master’s degree in Cyber Security, Computer Science, Information Systems, Engineering, Business, Healthcare Administration, or a related field, and/or equivalent combination of education and progressively responsible experience.

Licensure, Certification & Registration:

One or more relevant credentials such as CISSP, CISM, C-CISO, CRISC, HCISPP, GIAC, or a comparable security or executive credential preferred.

Experience:

Requires fifteen (15) or more years of progressively responsible cyber security, information security, technology risk, or related experience. Requires seven (7) or more years of leadership responsibility in complex environments, including experience advising executive leadership and governing bodies on material cyber risk. Health care experience strongly preferred.

Skills, Knowledge & Abilities:

Demonstrated experience in enterprise cyber security strategy, governance, risk management, incident response, resilience, security architecture, cloud and identity security, third-party risk, organizational design, financial planning, and executive communication.

Preferred Qualifications & Skills:

• Proven capability leading cyber security and risk initiatives in complex and dynamic environments. Knowledge of HIPAA/HITECH, NIST Cybersecurity Framework, HHS health care cyber security guidance, NIST AI Risk Management Framework, and applicable industry standards preferred.
• Dept/Unit Specific Skills: Deep knowledge of the Cyber Security domain, including artificial intelligence and generative AI security risks, AI governance, cloud and SaaS security, zero-trust architecture, security operations, data protection, application and API security, connected medical device security, and cyber resilience.

Pay Range:

The pay range listed for this position is the annual base salary range the organization reasonably and in good faith expects to pay for this position at this time.  In addition to base compensation, this position may be eligible for additional compensation, which may include performance-based incentive bonuses.

As a health care organization, we have a responsibility to do everything in our power to care for and protect our patients, our colleagues and our communities. Beth Israel Lahey Health requires that all staff be vaccinated against influenza (flu) as a condition of employment.

More than 35,000 people working together. Nurses, doctors, technicians, therapists, researchers, teachers and more, making a difference in patients' lives. Your skill and compassion can make us even stronger.

Equal Opportunity Employer/Veterans/Disabled