Guthrie · 3 days ago
VP, Cybersecurity/CISO - IT Administration - Full Time
Sayre, PA
Full-time
Hybrid
Director/Executive
8+ years expGuthrie is seeking a Vice President of Cybersecurity/CISO to join their Information Services Leadership team. The CISO will develop and oversee the organization's information security strategy, manage risk assessments, and ensure compliance with relevant regulations while leading a team responsible for various technology areas including security and infrastructure.
Health CareHospitalPersonal Health
Responsibilities
Manage the enterprise's information security and infrastructure services consisting of direct reports and indirect reports (such as individuals in business continuity and IT operations, external consultants, etc.). This includes hiring, training, staff development, performance management and annual performance reviews
Facilitate information security governance through the implementation of a Security Oversight Committee (SOC) governance program, including the formation of an information security steering committee or advisory board
Develop and publish up‐to‐date information security policies standards and guidelines. Oversee the approval, training, dissemination and maintenance of security policies and practices
Initiate, communicate and implement a risk‐based process for vendor risk management, including the assessment and treatment for risks that may result from partners, consultants and other service providers
Create and manage information security and risk management awareness training programs for all employees, contractors and approved system users
Knowledge and understanding of relevant legal and regulatory requirements, such as Sarbanes‐Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry/Data Security Standard
Work directly with the business units to facilitate IT risk assessment and risk management processes, and work with stakeholders throughout the enterprise on identifying acceptable levels of residual risk
Provide regular reporting on the current status of the information security program to enterprise risk teams, senior business leaders and the board of directors as part of a strategic enterprise risk management program
Create a framework for roles and responsibilities for information ownership, classification, accountability and protection
Develop and enhance an information security management framework based on the following: Examples might include International Organization for Standardization (ISO) 2700X, ITIL, COBIT‐5 /Risk IT and National Institute of Standards and Technology (NIST or HITRUST Core Security Framework (CSF)
Provide strategic risk guidance for IT projects, including the evaluation and recommendation of technical controls
Liaise with the enterprise architecture team to ensure alignment between the security and enterprise architectures, thus coordinating the strategic planning implicit in these architectures
Ensure that security programs are compliant with relevant laws regulations and policies to minimize or eliminate risk from audit findings
Define and facilitate the information security risk assessment process, including the reporting and oversight of treatment efforts to address negative findings
Develop a security incident event management program including the selection of SIEM and DLP tool set
Manage security incidents and events to protect corporate IT assets, including intellectual property, regulated data and the company's reputation
Monitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action
Liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure that the organization maintains a strong security posture
Coordinate the use of external resources involved in the information security program, including, but not limited to, interviewing, negotiating contracts and fees, and managing external resources
Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the security
Understand and interact with related disciplines through committees to ensure the consistent application of policies and standards across all technology projects, systems and services, including, but not limited to, privacy, risk management, compliance and business continuity management
Perform related duties and fulfill responsibilities as required
Qualification
Required
Bachelor's Degree in Information Technology, Computer Science, Information Security or other related area
Minimum of eight to 10 years of experience in a combination of risk management, information security and IT jobs
At least four years must be in a senior leadership role
Employment history must demonstrate increasing levels of responsibility
Excellent written and verbal communication skills
Interpersonal and collaborative skills
Ability to communicate security and risk‐related concepts to technical and nontechnical audiences
Proven track record and experience in developing information security policies and procedures
Successfully executing programs that meet the objectives of excellence in a dynamic environment
Poise and ability to act calmly and competently in high‐pressure, high‐stress situations
Must be a critical thinker, with strong problem‐solving skills
Knowledge and understanding of relevant legal and regulatory requirements, such as Sarbanes‐Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry/Data Security Standard
Exhibit excellent analytical skills
Ability to manage multiple projects under strict timelines
Ability to work well in a demanding, dynamic environment and meet overall objectives
Project management skills: financial/budget management and resource management
Must have a strong hands‐on/technical knowledge of core Microsoft technologies including but not limited to Windows Servers, Active Directory, MS SQL and core Network/Cisco technologies like LAN/WAN, subnets, firewalls, VLAN's, and VPN using Cisco switches, routers and ASA's
Ability to lead and motivate cross‐functional, interdisciplinary teams to achieve tactical and strategic goals
Certification is required in the first 12 months
Knowledge of common information security management frameworks, such as ISO/IEC 27001, ITIL, COBIT, NIST and HITRUST
Experience in the operation of a security operations center (SOC)
Significant experience in the areas of incident response, digital forensics, and vulnerability management
Demonstrated implementation of NIST or HITRUST Security Framework to move an organization from a Level 1 Maturity Scale to a Level 3 or greater
Experience with contract and vendor negotiations
High level of personal integrity
Ability to professionally handle confidential matters
High degree of initiative, dependable and ability to work with little supervision
Some travel required to regional offices and hospitals
Preferred
Advanced degree preferred
Familiarity with the Office of Civil Rights and their ePHI enforcement procedures is desirable
Certifications in Microsoft/Cisco/VMware and Epic technologies preferred
ITIL or PMI Certification is preferred
Professional security management certification, such as a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials, is desired
Company
Guthrie
Health care
5001-10000 employees
H1B Sponsorship
Guthrie has a track record of offering H1B sponsorships. Please note that this does not
guarantee sponsorship for this specific role. Below presents additional info for your
reference. (Data Powered by US Department of Labor)
Distribution of Different Job Fields Receiving Sponsorship
Represents job field similar to this job
Trends of Total Sponsorships
2024 (1)
2023 (1)
2022 (1)
Funding
Current Stage
Late StageTotal Funding
unknownKey Investors
Fidelis Care
2025-05-14Grant
Leadership Team
Edmund Sabanegh
President & Chief Executive Officer, The Guthrie Clinic
Brad Carvellas
SVP, Chief Digital Officer
Recent News
Central New York Business Journal
2026-01-03
2025-12-24
2025-09-23
Company data provided by crunchbase