AVP Solutions Architecture

The AVP, Information Security leads the enterprise information security program and the day-to-day protection of the organization’s clinical and corporate technology environments. The AVP directs security operations, threat detection, incident response, vulnerability management, identity and access management, HIPAA security compliance, and data governance. This role advises executive leadership during security events, partners with technology and clinical leaders to incorporate security requirements into operations and builds a high-performing security team that protects systems, sensitive data, and protected health information., * Directs enterprise security operations, including threat monitoring, detection, investigation, containment, recovery, and post-incident review across clinical and corporate environments.

• Develops and matures Security Operations Center capabilities, monitoring coverage, operating procedures, escalation paths, and supporting security technologies.
• Owns the incident response program, including playbooks, tabletop exercises, digital forensics coordination, lessons learned, and timely communication with executive and board leadership.
• Leads the enterprise vulnerability management program, including scanning, risk-based prioritization, remediation tracking, exception management, and reporting across enterprise and clinical systems.
• Maintains a healthcare-focused threat intelligence capability and coordinates preventive and responsive action for ransomware, phishing, business email compromise, and other sector-relevant threats.
• Establishes enterprise identity and access management strategy and controls for authentication, single sign-on, multifactor authentication, conditional access, privileged access, and access governance.
• Leads the HIPAA security compliance program, including security risk assessments, control documentation, policy maintenance, corrective action tracking, audit readiness, and regulatory support.
• Establishes data governance practices for the classification, protection, retention, and lifecycle management of sensitive data and protected health information in partnership with Compliance and clinical stakeholders.
• Partners with infrastructure, network, application, and clinical technology teams to incorporate security requirements into architecture, design, implementation, and ongoing operations.
• Selects and oversees security technologies and service providers; manages vendor performance, contracts, service levels, and managed or co-sourced security operations relationships.
• Builds and leads a multidisciplinary team of security professionals; establishes clear accountabilities, staffing models, on-call coverage, development plans, and performance expectations.
• Defines and reports security metrics, key performance indicators, risk trends, and program priorities to the Chief Technology Officer / Chief Information Security Officer and executive leadership.
• Directs security due diligence, risk assessment, and operational integration for acquisitions and newly affiliated facilities.
• Develops and manages department priorities, budgets, resource plans, and roadmaps aligned with organizational risk and business needs.
• Maintains current knowledge of cybersecurity threats, regulatory requirements, and industry practices and applies that knowledge to the enterprise security program.

• Communicator
• Creative
• Deadline-oriented
• Goal-oriented
• Problem-solver
• Strategic, * Expert knowledge of security operations, Security Information and Event Management (SIEM), Security Orchestration Automation and Response (SOAR), endpoint detection and response, and structured incident response methods.
• Advanced knowledge of vulnerability management, cyber threat intelligence, digital forensics coordination, and healthcare-targeted threats.
• Strong knowledge of HIPAA and HITECH security requirements, security risk assessment, control documentation, policy governance, and regulatory audit support.
• Strong knowledge of enterprise identity and access management, including Microsoft Entra ID, Privileged Identity Management, Conditional Access, multifactor authentication, and single sign-on.
• Knowledge of data classification, protection, retention, and lifecycle management for sensitive data and protected health information.
• Knowledge of enterprise security technologies, including Microsoft Defender, Microsoft Sentinel, email security, and vulnerability scanning platforms.
• Ability to assess complex security risks, set priorities, make sound decisions under pressure, and direct coordinated response during active incidents.
• Ability to translate technical risk into clear business implications and communicate effectively with executives, board members, regulators, clinicians, and technical teams.
• Ability to lead, develop, and retain a geographically dispersed, multidisciplinary team and manage on-call and service delivery expectations.
• Ability to build effective partnerships, manage vendors and budgets, establish measurable performance standards, and drive remediation across organizational boundaries., * Bachelor’s Degree in Computer Science, Information Technology, Cybersecurity, or a related field (Preferred) Or
• Other: An equivalent combination of relevant education and professional experience in lieu of the preferred degree (May be Considered)

Licenses/Certifications

• Other: Current Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), or GIAC Certified Intrusion Analyst (GCIA) certification Upon Hire (Required)
• Other: Additional relevant certification such as CISM, GCFA, OSCP, Microsoft Certified Identity and Access Administrator Associate, CDPSE, or CIPT Upon Hire (Preferred), * 10+ years progressive cybersecurity experience, including significant responsibility for security operations and/or incident response (Required)
• Prior Experience leading a cybersecurity team of six (6) or more employees (Required)
• Prior Experience protecting sensitive or regulated data in healthcare or another highly regulated, multi-site organization (Required)
• Prior Experience leading HIPAA security or comparable compliance activities and supporting regulatory audits (Required)
• Prior Experience with enterprise identity and access management, privileged access, data governance, security technologies, and managed or co-sourced security service providers (Required)
• Prior Experience in a private-equity-owned, multi-site healthcare organization and with security due diligence or integration related to mergers and acquisitions (Preferred)

• Career Development We support growth and development for all our employees through various means and in programs designed to foster inclusion.

• Healthcare Your health is important to us. We offer a comprehensive benefits program and resources to support healthy lifestyles for you and your family.

• Retirement Plan Employees can contribute to their retirement with plans that allow for pre-tax or after-tax contributions through payroll deductions.

• Paid Time Off With paid holidays and PTO, you are encouraged to take the time you need to relax and recharge with family and friends.

• Work-Life Balance Work-life balance is not just a perk, it is encouraged. We believe that our employees work their best when they’re allowed to be their best selves in and out of the office.

• Miscellaneous Benefits Whether you’re looking for pet insurance, identity theft protection, or select discounts from hundreds of local and national merchants, we have a variety of benefits that help provide peace of mind.

ScionHealth strives to provide quality-driven, patient-centered acute and post-acute hospital solutions. The health system is focused on driving innovation, serving its communities, and investing in people and technology to deliver compassionate patient care and excellent health outcomes. Based in Louisville, ScionHealth operates 79 hospital campuses in 25 states - 61 long-term acute care hospitals and 18 community hospital campuses and associated health systems., * Driven by quality: We believe that if we focus on delivering quality care, exceeding expectations related to customer service and supporting our people, our business results will follow.

• We equip our hospitals and our people with the resources, technology and expertise they need to deliver the best possible care to patients.
• We’re always looking to find better ways to support caregivers by improving what we do, sharing best practices, and responding to the changing needs of our people and the patients they serve., At ScionHealth, we empower our caregivers to do what they do best. We value every voice by caring deeply for every patient and each other. We show courage by running toward the challenge and we lean into new ideas by embracing curiosity and question asking. Together, we create our culture by living our values in our day-to-day interactions with our patients and teammates.