Description

Position Summary

Leads Iowa Hospital Association’s (IHA) operational and technical cybersecurity program, reporting to the Senior Vice President, IT Operations & Security. Provides strategic leadership and advanced technical oversight across security operations, engineering, architecture, governance and risk management. Ensures the confidentiality, integrity and availability of IHA’s information assets while aligning cybersecurity initiatives with organizational strategy, regulatory requirements and industry best practices. This role reflects IHA’s behaviors of ownership, collaboration, innovation and servant leadership.

Responsibilities

Leads the development, execution and continuous improvement of IHA’s enterprise cybersecurity strategy, roadmap and operating model with authority to set priorities and recommend investments; delivers annual roadmap milestones and reduces identified enterprise cyber risks
Oversees security operations, including Security Information and Event Management (SIEM), Managed Detection and Response (MDR) and Security Operations Center (SOC) services, vulnerability management, and incident detection, response and recovery; empowered to activate response plans and engage external sources as needed to reduce severity of security incidents and increase timely closure of corrective actions
Coordinates and leads tabletop exercises and disaster recovery drills, ensuring lessons learned and corrective actions are documented and implemented
Owns and governs cloud-based and on premises security architecture, approving designs and control decisions to ensure secure-by-design principles and defense-in-depth controls with reduction in critical and high-risk findings and conformance with approved architecture standards
Establishes, maintains and enforces cybersecurity policies, standards and control frameworks aligned with the System and Organization Controls (SOC) 2, National Institute of Standards and Technology (NIST), Cybersecurity Framework (CSF), Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health Act (HITECH) requirements, as applicable for successful audit results, ideal compliance posture, and timely remediation of control deficiencies
Manages third party cybersecurity risk, including vendor assessments, tool evaluations and ongoing risk monitoring with authority to approve risk treatment recommendations within defined thresholds
Measures, reports and communicates cybersecurity risk posture through meaningful metrics, key performance indicators (KPI), executive dashboards and playbooks, translating technical/cyber risk into business, operational, financial and reputational impact for executive stakeholders
Partners with Human Resources and Marketing Communications to design and deliver an effective, organization-wide security awareness and training program ensuring high completion rates, phishing simulation outcomes, and reduction in user-driven security incidents
Engages in continuous learning to stay current with evolving threats, technologies and regulatory expectations and proactively adopts relevant controls and provides informed recommendations to leadership
Models and promotes safe work practices, including proper workstation ergonomics, to support employee well-being and injury prevention
Performs other related duties as assigned to support departmental and organizational goals

Internal Relationships

Works closely with the Senior Vice President, IT Operations & Security to align cybersecurity initiatives with enterprise priorities
Collaborates with department leaders, legal, HR and operational teams to embed security into business processes

External Relationships

Coordinates with cybersecurity vendors, managed service providers, auditors and consultants
Engages with external partners, peer organizations and industry groups for benchmarking and shared learning

Requirements

Knowledge and Skills

Advanced knowledge of threat detection and response, vulnerability management, risk management and security architecture
Strong understanding of cloud security, identity and access management and modern endpoint and email security platforms
Proficiency in developing metrics, KPIs and executive-level reporting
Excellent communication, facilitation and stakeholder management skills

Education And Experience

Bachelor’s degree in cybersecurity, information security, computer science, or a related field preferred
Minimum ten (10) years of experience in cybersecurity leadership and/or senior security engineering roles required
CompTIA A+ Certification or equivalent required; Microsoft Certified Professional (“MCP”) preferred
Demonstrated ability to lead complex cybersecurity programs; coordinating major security incidents and response activities
CISSP Certified Information Systems Security Professional (CISSP) certification required; Certified Information Security Manager (CISM), Cloud Security Certification (CCSP), Global Information Assurance Certification (GIAC), or Information Technology Infrastructure Library (ITIL v4) experience preferred
Experience integrating security awareness platforms (e.g., KnowBe4) with Microsoft Defender and email security controls
An equivalent combination of education, training and experience may be considered

Physical Requirements

Prolonged periods sitting at a desk and working on a computer
Must be able to lift up to 25 pounds at times and on occasion, up to 50 pounds
Ability to support organizational events, which may occasionally require extended periods of standing, light lifting, or schedule flexibility

Equal Opportunity Employer

Qualified applicants will be considered despite race, color, religion, creed, sex, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability or any other protected class.

Iowa Hospital Association

Vacatures

Vice President, Cybersecurity