Director of Cybersecurity

Job Title

Director of Cybersecurity

Department

Information Technology

Reporting Structure

Vice President of IT Services

Pay Grade/Salary

11

Exempt/Non-Exempt

Exempt

Bargaining Unit:

n/a

Work Location

Varies

Employment Status (FTE)

1.0

Job Summary

The Director of Cybersecurity leads DWIHN’s cybersecurity program, including security operations, risk management, governance, regulatory compliance, and incident response. This position also serves as DWIHN’s designated HIPAA Security Officer, with responsibility for overseeing the development, implementation, and maintenance of the administrative, physical, and technical safeguards required by the HIPAA Security Rule. The Director works with IT Services, Privacy, Compliance, Legal, and operational leadership to protect electronic protected health information (ePHI), address security risks, and support the secure delivery of behavioral health services. The position reports to the Vice President of IT Services.

Essential Duties & Responsibilities

• Lead, supervise, mentor, and evaluate cybersecurity staff and establish priorities.
• Develop and maintain security policies, standards, procedures, and controls.
• Oversee security monitoring, threat detection, vulnerability management, and incident response.
• Coordinate incident investigations, containment, recovery, documentation, and escalation.
• Oversee network, endpoint, cloud, identity, logging, and data protection controls.
• Lead cybersecurity risk assessments, penetration testing, and remediation tracking.
• Coordinate security audits, including DWIHN’s SOC for Cybersecurity examination.
• Serve as the designated HIPAA Security Officer, coordinating DWIHN’s HIPAA Security Rule compliance activities and working with the Privacy Officer, Compliance, and Legal on overlapping privacy and security matters.
• Oversee HIPAA security risk analysis and risk management, security policies and procedures, workforce security awareness, security incident procedures, contingency planning, and periodic evaluation of safeguards for ePHI.
• Align security practices with NIST CSF 2.0, NIST SP 800-53, and CIS Controls.
• Evaluate vendor security risks and contractual security requirements.
• Integrate cybersecurity into IT projects and system implementations.
• Support business continuity and disaster recovery planning and testing.
• Oversee employee security awareness training.
• Maintain security records, risk registers, and audit evidence.
• Manage assigned security budgets, resources, and vendors.
• Report cybersecurity risks, incidents, and remediation status to the VP of IT Services.

Required Education & Experience:

REQUIRED EDUCATION:

REQUIRED EXPERIENCE:

• 7 years of progressive cybersecurity experience, including 3 years in management.
• Experience leading security operations, incident response, risk assessments, audits, and HIPAA security compliance activities.
• Thorough knowledge of the HIPAA Security Rule, HIPAA security risk analysis and risk management, NIST frameworks, and healthcare information security requirements.

• Healthcare, behavioral health, or public-sector experience preferred.

Preferred Certifications

WORKING CONDITIONS:

This position is hybrid, with work performed onsite and remotely. Occasional travel and after-hours availability may be required for cybersecurity incidents, audits, or critical implementations.

This description is not intended to be a complete statement of job content, rather to act as a general description of the essential functions performed. Management retains the discretion to add or change the position at any time.

EEOC Statement

DWIHN is an Equal Employment Opportunity Employer committed to fair, consistent, and merit-based hiring practices. All qualified applicants are considered for employment without regard to race, color, religion, sex, national origin, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity, or any other status protected under applicable federal, state, local law.

Employment decisions are based solely on job-related qualifications, demonstrated competencies, and organizational needs. DWIHN maintains policies and procedures designed to ensure that recruitment, selection, promotion and all other employment actions are conducted in a manner that is objective, equitable and non-discriminatory.