Security Consultant

Job Summary

The Security Consultant serves as a trusted advisor to healthcare clients, partnering with the Fortified vCISO team to advance organizational security maturity and reduce enterprise risk. This role supports the development, execution, and continuous improvement of clients’ cybersecurity governance programs, aligning security strategy with business objectives, regulatory requirements, and evolving threat landscapes.

The Security Consultant evaluates security program effectiveness, identifies control gaps, and provides risk-based recommendations across administrative, technical, and operational domains. Responsibilities include advisory support for strategic security initiatives, policy and standards development, corrective action planning, risk reporting and executive-level communication, and oversight of technology and control implementations to ensure alignment with organizational risk tolerance.

Working closely with clients and vCISOs, the Security Consultant translates technical findings into actionable governance and risk management improvements. This role contributes to the design of sustainable security programs, supports board- and executive-level reporting, and helps guide clients toward measurable maturity improvements.

The ideal candidate brings a strong foundation in information security (healthcare preferred), demonstrates technical fluency across modern security architectures, and possesses the ability to lead risk-focused discussions with both technical teams and executive stakeholders. Strong analytical skills, project leadership capability, and comfort operating in dynamic healthcare environments are essential.

Essential Job Functions

The following duties are normal for this position. The omission of specific statements of duties does not exclude them from being expected of this position if the work is similar, related, or a logical assignment for this position. Other duties may be required.

· Have an understanding of healthcare business operations, the healthcare cybersecurity landscape, and the healthcare regulatory environment.

· Assist vCISOs in the identification and proposal of key information security priorities, initiatives, plans, practices, and tools.

· Collaborate with various Fortified departments, Client stakeholders, and third parties to ensure a holistic approach to cybersecurity.

· Research potential and emerging information security threats, vulnerabilities, and potential control techniques and communicate this information to client contacts.

· Develop and mature cybersecurity risk management policies, procedures, standards, and operational runbooks to strengthen governance, ensure regulatory alignment, and support effective risk mitigation.

· Engage with client security leadership and technical teams to evaluate control effectiveness, perform security testing, and provide actionable recommendations to remediate identified vulnerabilities.

· Develop and mature Fortified-wide best practices for IT security.

· Research security enhancements and make recommendations to vCISOs/client leadership.

· Stay up-to-date on information technology trends and security standards.

· Facilitate structured root cause analysis following security incidents to identify control deficiencies, process gaps, and opportunities to strengthen the organization’s overall security posture.

· Guide clients in assessing vendor security controls and working collaboratively with third parties to ensure adherence to HIPAA, contractual, and organizational security requirements.

· Ability to work independently, multitask, and prioritize daily workload.

· Resourcefulness and ability to take the initiative in development and completion of work projects.

· Other duties as assigned

Knowledge & Skills

Education & Experience

· Bachelor's degree from a four-year college or university or combination of education and experience.

· Strong understanding of technical cybersecurity concepts, firewalls, intrusion detection/prevention systems (IDS/IPS), MFA, Configuration Management, Asset Management, DLP, Application Control, etc.

· Strong understanding of security governance to include policy development, risk management, security awareness, third party risk, and metrics.

· Information security leadership experience in a hospital setting highly preferred

· A consultative background is preferred

· Demonstrated ability to evaluate and advise on security operations technologies, including SIEM, SOAR, and endpoint detection platforms.

· Working knowledge of cloud security principles and risk considerations across major cloud service providers (e.g., AWS, Azure, GCP).

· Foundational understanding of enterprise networking concepts sufficient to assess risk, segmentation strategies, and control effectiveness.

Special Skills & Knowledge

· Demonstrate strong problem-solving skills and a desire to learn; be a proactive self-starter with a can-do attitude; excellent customer relationships skills; excellent communication skills; ability to handle sensitive information; good verbal and written skills, team player.

· Analytical mindset, and critical thinking abilities; data driven.

· Self-motivated individual capable of working in a fast-paced, dynamic environment.

· Detail and results oriented, skilled at both planning and hands-on execution.

· Ability to excel in a team-oriented, collaborative, and fast-paced environment.

· Excellent written, verbal, and presentation skills.

· Working knowledge concerning network technology including LAN, WAN concepts, wireless technology, and VOIP concepts preferred.

· Troubleshooting skills.

· Must have strong analytical and problem-solving skills, as well as excellent interpersonal and communication skills and abilities.

· Ability to effectively communicate with a wide range of individuals and constituencies in a diverse healthcare setting.

Licenses, Certifications, etc.

· A foundational cybersecurity certification (e.g., Security+, SSCP, GSLC) or equivalent professional experience is required.

· Advanced certifications demonstrating expertise in security governance, risk management, and healthcare cybersecurity are strongly preferred (e.g., CISSP, CISM, CHISL, CRISC, CISA, GRISO, GSEC, or equivalent).

· Candidates without advanced-level certifications must demonstrate a clear path toward attainment of advanced credentials

Requirements

Supervisory Responsibility

· N/A

Working Conditions

This position will primarily work remotely, but occasional travel may be required.

Fortified Health Security is an Equal Opportunity Employer. In compliance with the Americans with Disabilities Act, Fortified Health Security will provide reasonable accommodations to qualified individuals with disabilities. If a reasonable accommodation is needed to perform this position, you need to inform Fortified Health Security People and Culture Team of such request. Signatures below indicate the receipt and review of this job description by the associate assigned to the position and the People and Culture Team.