#2021-O-0096 Director, IT Information Security Officer (Remote Acceptable)

Director, IT Information Security Officer

• Coordinates the continuous development, implementation and updating of security and privacy policies, standards, guidelines, baselines, processes, and procedures in compliance with local, state, and federal regulations and standards for INVIDI information systems.
• Develop and manage the frameworks, processes, tools, and consultancy necessary forIT to properly manage risk and to make risk-based decisions related to ITactivities.
• Proactive identification andmitigation of IT risks as well as responding to observations identified by thirdparty auditors or examiners while assisting in the development of periodic reports and dashboards presenting the level ofcontrols compliance and current IT risk posture.
• Assist IT managers and staff with the audits and facilitatemanagement response and remediation efforts. Ensure overall IT compliance withregulatory requirements through proactive planningand communication, ownership, and relationships.
• Broaden and deepen knowledge of the business and environment ofIT with respect to the delivery of projects, strategic initiatives, and systemsportfolio to effectively assist IT managers and staff with risk and compliancemanagement.
• Identify acceptable levels of residual risk and assist with actionplans, policy, and procedural changes for risk mitigation. Provide strategicrecommendations to key IT projects to help improve project results, quality ofdeliverables, risk optimization, security processes and compliance with regulations.
• Assist in the management of IT security budgets. Forecast and develop budget requirements and expenditures.
• Facilitate information systems security management education and training in regulatory and industry standards for all IT employees.
• Receives allegations of security incidents and conducts complex investigations; prepares written findings, recommendations and follow up evaluation; and analyzes patterns and trends.
• Coordinates INVIDI information security incident response and reporting for events or exploited vulnerabilities including unauthorized system or network access, denial of service, inappropriate data access, data corruption, and/or collection of private or confidential information.
• Acts as ombudsman for disputes, requests for exceptions and complaints regarding INVIDI wide information systems security policies, practices, and related issues.
• Works as a liaison with local, state, and federal authorities requiring information and reports on security incidents to include law enforcement agencies.

• 10 + years working as a Senior Systems Engineer, Architecture Engineer, or relative work experience
• Bachelor's degree in Computer Science or related field. IT experience with increased responsibility of IT roles may substitute for a degree.

• Experience in risk, compliance, and information security policy development.
• Knowledge and understanding of higher education, governmental agency or corporate/industry information security, governance, risk and compliance practices and standards.
• Knowledge of laws and regulations including but not limited to: Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability Accountability Act (HIPAA), Gramm-Leach-Bliley (GLB) Act and Sarbanes-Oxley.
• Experience with development of educational programs in the area of security awareness.
• Excellent organizational and communication skills (both oral and written).
• Strong interpersonal skills and the ability to effectively communicate with a wide range of individuals and constituencies in a diverse community.
• Experience managing budget and managing a team of information technology professionals.
• Proven problem solver with ability to provide in-depthanalysis of complex problems, manage risk and provide timely and accurate decisions.
• Knowledge of IT processes and controls and strong understanding ofrisk and control frameworks such as (CoBIT, ISO, NIST, ITIL, PCI).
• General knowledge of informationsecurity regulatory requirements and standards such as ISO 27001/2, SANS top 20 and NIST 800-53.
• Possess Certified Information Systems Security Professional (CISSP) or other information systems security certifications or possess training in IT security disciplines.
• Ability to ensure standards and parameters for any systems on the INVIDI network are correct and as close to flawless as reasonably can be expected.

• INVIDI is a conscious, clean, well-organized, and supportive office environment; must be able to work in server room and office environments.
• Prolonged periods of sitting at a desk and working on a computer are normal; on-call/after-hours work is likely due to the nature of IT work.
• Ability to lift 50lbs (22kgs).
• Some travel between offices required by project or issue.

• INVIDI is working remotely 100% until a return-to-office date is determined.
• All candidates must pass a successful background screening (including professional reference checks and drug testing) requirements.
• All candidates must be legally authorized to work in the United States (Visa sponsorship is not available for this position) .