VP - Chief Information Security Officer

Inspire health. Serve with compassion. Be the difference.

Job Summary

The Vice President, Chief Information Security Officer (CISO) leads Prisma Health’s enterprise cybersecurity and information security strategy, program, and capabilities. The CISO protects the confidentiality, integrity, availability, and resilience of Prisma Health’s information, technology, clinical systems, connected medical devices, digital platforms, and data while enabling clinical, operational, digital, and strategic priorities.
The CISO serves as a senior advisor to executive leadership and the Board on cyber risk and provides leadership for cybersecurity governance, security architecture and engineering, security operations, identity and access management, incident response, third-party risk, data protection, and workforce awareness. The CISO also serves as Prisma Health’s designated Security Official under the HIPAA Security Rule.

Essential Functions

• Develops and executes an enterprise cybersecurity strategy and roadmap aligned with Prisma Health’s clinical, operational, technology, digital, financial, and strategic objectives.
• Establishes an enterprise cyber-risk management program, including risk assessment, prioritization, treatment, acceptance, metrics, and reporting. Partners with leadership to define risk appetite and remediation priorities.
• Communicates cyber posture, material risks, emerging threats, incidents, investments, and remediation progress to executive leadership and the Board. Translates technical risk into business, clinical, financial, operational, and patient-safety implications.
• Leads threat monitoring, detection, intelligence, vulnerability management, incident response, and digital forensics. Directs executive response to material cyber incidents in coordination with clinical, technology, privacy, compliance, legal, communications, and external partners.
• Partners with technology, clinical, emergency management, and business continuity leaders to strengthen the resilience and recoverability of critical services. Ensures cyber incident response and recovery plans are maintained, exercised, and continuously improved.
• Establishes security architecture, standards, and controls across infrastructure, networks, endpoints, applications, cloud services, SaaS platforms, data, APIs, and emerging technologies.
• Provides strategic leadership for identity governance, authentication, authorization, privileged access, access lifecycle management, and Zero Trust capabilities.
• Provides cybersecurity governance for clinical systems, connected medical devices, biomedical technologies, IoMT, operational technology, and other cyber-physical systems. Treats cybersecurity as an essential component of patient safety and clinical resilience.
• Establishes security requirements and governance for cloud computing, artificial intelligence, generative AI, digital platforms, automation, APIs, and data platforms.
• Leads cybersecurity risk management for vendors, business associates, cloud providers, strategic partners, joint ventures, acquisitions, affiliations, divestitures, and supply-chain dependencies.
• Partners with Privacy, Compliance, Legal, Internal Audit, and data governance leaders to protect ePHI, PII, confidential business information, and other sensitive data. Maintains cybersecurity policies, standards, controls, and compliance with applicable laws and frameworks.
• Builds a strong cybersecurity culture through enterprise awareness, role-based education, phishing resilience, and behavioral programs.
• Builds and retains a high-performing cybersecurity organization; oversees workforce planning, succession, vendor performance, operating and capital budgets, and risk-based investment prioritization.
• Represents Prisma Health with regulators, law enforcement, government agencies, cyber insurers, auditors, and industry partners, including during compliance reviews and investigations.
• Demonstrates and promotes Prisma Health’s purpose: Inspire health. Serve with compassion. Be the difference.

• Performs other duties as assigned.

Supervisory/Management Responsibility

• Provides executive leadership for Prisma Health’s cybersecurity organization, with direct and indirect responsibility for leaders, team members, managed services, vendors, talent development, performance management, succession planning, and operating and capital budgets. Serves as a member of Prisma Health management and collaborates broadly across clinical, operational, financial, technology, digital, compliance, and administrative leadership.

Minimum Requirements

Education

Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Computer Science, Information Systems, Engineering, Business Administration, or a related field. Master’s degree in a relevant discipline preferred.

Experience

· Ten (10) or more years of progressively responsible experience in cybersecurity, information security, technology risk, or related disciplines, including significant leadership experience in a large, complex organization.

· Demonstrated experience leading multiple cybersecurity disciplines and managing enterprise cyber risk.

· Experience in healthcare or another highly regulated industry strongly preferred.

· Experience communicating cybersecurity strategy, risk, incidents, and investment priorities to executive leadership and Boards or Board committees.

In Lieu Of

• An equivalent combination of relevant education, cybersecurity leadership experience, technology experience, and demonstrated executive-level capability may be considered in accordance with organizational policy.

Required Certifications, Registrations, Licenses

• One recognized advanced cybersecurity certification, such as CISSP, CISM, CRISC, HCISPP, or a comparable credential, is required or must be obtained within twelve (12) months of appointment, subject to Prisma Health requirements.

Knowledge, Skills and Abilities

• Exceptional executive leadership, communication, influence, judgment, and relationship-management capabilities.
• Ability to translate complex cybersecurity risk into clear business, clinical, operational, financial, and patient-safety implications.
• Demonstrated experience developing and executing enterprise cybersecurity strategy in a large, complex organization.
• Deep knowledge of security architecture, cloud security, identity and privileged access, security operations, vulnerability management, incident response, data protection, application security, and third-party risk.
• Strong understanding of healthcare cybersecurity, clinical systems, connected medical devices, IoMT, and the availability and resilience requirements of care delivery.
• Knowledge of HIPAA, HITECH, the NIST Cybersecurity Framework, applicable NIST guidance, PCI DSS, and relevant federal and state requirements
• ·Understanding of security risks related to artificial intelligence, generative AI, cloud services, APIs, automation, and emerging technologies.
• Experience establishing cybersecurity metrics, key risk indicators, executive dashboards, and Board-level reporting.
• Strong business and financial acumen, including risk-based investment prioritization and budget management.
• Ability to recruit, develop, retain, and lead high-performing cybersecurity professionals and leaders.

Work Shift

Day (United States of America)

Location

Greenville Memorial Hospital

Facility

Corporate

Department

Information Security

Share your talent with us! Our vision is simple: to transform healthcare for the benefits of the communities we serve. The transformation of healthcare requires talented individuals in every role here at Prisma Health.