Location: Chicago, Illinois
Business Unit: Rush Medical Center
Hospital: Rush University Medical Center
Department: Cybersecurity Engineering
Work Type: Full Time (Total FTE between 0.9 and 1.0)
Shift: Shift 1Work Schedule: 8 Hr (8:00:00 AM - 5:00:00 PM)
Pay Range: $63.10 - $94.02 per hour
Rush salaries are determined by many factors including, but not limited to, education, job-related experience and skills, as well as internal equity and industry specific market data. The pay range for each role reflects Rush's anticipated wage or salary reasonably expected to be offered for the position. Offers may vary depending on the circumstances of each case.
Summary:Lead the future of AI security at Rush! Rush University Medical Center is seeking a Director of AI Security to establish and lead our enterprise AI Security Program, helping ensure the safe, secure, and responsible use of artificial intelligence across our health system.
As AI technologies, including machine learning, generative AI, and copilots, continue to transform healthcare, this role will play a critical part in protecting the systems, data, and infrastructure that support these innovations. You will develop and implement AI security strategies, policies, governance practices, and risk management controls to address emerging threats, protect sensitive patient information, and support regulatory compliance.
Working in close partnership with Information Security, Data Science, Clinical Informatics, Engineering, Privacy, Compliance, Legal, and executive leadership, you will embed security throughout the AI lifecycle-from development and deployment to ongoing monitoring. You will lead AI-specific risk assessments, oversee third-party AI vendor security evaluations, develop incident response strategies, and establish controls to address emerging threats such as prompt injection, data poisoning, model manipulation, and unauthorized data exposure.
This is an exciting opportunity to build and mature a critical security function at the enterprise level, influence how AI is adopted across a leading academic health system, and help balance innovation, patient safety, privacy, and security as healthcare continues to evolve.
Responsibilities:AI Security Strategy & Program Management:
- Develop, implement, and manage a comprehensive AI security program aligned with Rush's organizational strategy, risk tolerance, and regulatory requirements.
- Define and maintain AI security policies, standards, procedures, and guidelines governing the secure use of AI/ML systems across the health system.
- Establish and track KPIs and metrics to measure the effectiveness of the AI security program.
- Stay current on emerging AI threats, vulnerabilities, and regulatory developments and adjust the program accordingly.
Risk Management & Compliance:
- Lead AI-specific risk assessments across clinical, administrative, research, and operational AI use cases to identify, prioritize, and remediate security, privacy, compliance, and patient safety risks.
- Ensure AI security practices align with applicable regulations, standards, and frameworks, including HIPAA, NIST AI RMF, and emerging state and federal AI governance requirements.
- Partner with Legal, Compliance, Privacy, Risk Management, and Data Governance teams to ensure AI security controls meet contractual, regulatory, ethical, and institutional obligations.
- Work with the GRC team to maintain an AI risk register, track remediation activities, and report AI risk posture to senior leadership and governance committees on a regular cadence.
AI Threat Detection & Incident Response:
- Identify and assess AI-specific threats, including adversarial attacks, model manipulation, data poisoning, prompt injection, model inversion, unauthorized automation, and data leakage.
- Develop and maintain AI-specific incident response plans, playbooks, and escalation procedures in coordination with Information Security, IT, Privacy, Compliance, Legal, and operational teams.
- Lead or support investigations of AI security incidents, including root cause analysis, impact assessment, containment, remediation, and lessons learned.
- Collaborate with the Security Operations Center to monitor AI systems, AI-enabled applications, and related data flows for anomalous, unauthorized, or malicious activity.
AI Lifecycle Security:
- Partner with data science, clinical informatics, and engineering teams to embed security practices throughout the full AI lifecycle - including data ingestion, model training, validation, deployment, and ongoing monitoring
- Establish secure development and deployment standards for AI/ML models, including data governance, access controls, and auditability requirements
- Review and assess AI models and pipelines for security vulnerabilities prior to production deployment
- Define and enforce controls around the use of PHI, PII, research data, and other sensitive patient and operational data in AI training, tuning, inference, and output generation
- Ensure AI systems are monitored after deployment for drift, misuse, unauthorized access, data exposure, and other security or safety concerns
Third-Party & Vendor AI Governance:
- Evaluate and assess the security posture of third-party and vendor-supplied AI tools, platforms, copilots, and AI-enabled applications used across Rush's clinical, administrative, research, and operational environments.
- Develop and maintain a vendor AI risk assessment framework, including security, privacy, data protection, monitoring, and contractual requirements for AI-related procurement processes.
- Partner with Supply Chain, Legal, Privacy, Compliance, IT, and business stakeholders on AI vendor due diligence, contract reviews, data-use terms, and risk acceptance decisions.
- Monitor ongoing compliance, security performance, and risk posture of third-party AI vendors, and escalate concerns as appropriate.
- Ensure vendor AI solutions include appropriate controls for PHI, PII, research data, access management, auditability, data retention, model training restrictions, and incident notification.
Leadership & Collaboration:
- Lead, mentor, and develop the AI security team, fostering a culture of innovation, accountability, and continuous learning
- Serve as a subject matter expert and trusted advisor to clinical, operational, and executive leadership on AI security matters
- Collaborate with the Director of Security Architecture and other IT security leaders to ensure alignment between AI security operations and broader health system security strategies
- Represent Rush's AI security program in external forums, industry groups, and regulatory engagements as appropriate
- Drive awareness and education initiatives to promote responsible and secure AI use across the organization
Required Job Qualifications- Bachelor's degree in Computer Science, Information Security, Data Science, or a related field
- Minimum 8-10 years of progressive experience in information security, cybersecurity risk, security architecture, data security, or emerging technology risk, including 2 + years focused on AI/ML security or demonstrated AI/ML security work within a broader data security or emerging technology risk role
- Minimum 3 years of leadership or management experience, including direct oversight of teams and cross-functional collaboration
- Proven experience in conducting security risk assessments and developing security programs within complex health systems, enterprises, academic medical centers, or regulated environments
- Hands-on experience with AI/ML frameworks, tools, and platforms, and understanding of associated security risks
- Experience evaluating and managing third-party technology vendors from a security and risk perspective
- Deep understanding of AI/ML concepts, architectures, and the unique security risks they introduce, including adversarial machine learning, model theft, data poisoning, and prompt injection
- Strong knowledge of healthcare regulatory requirements, such as HIPAA
- Familiarity with AI governance and risk frameworks, including NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, and the EU AI Act
- Proficiency in security risk assessment methodologies and experience applying them to AI/ML systems and data pipelines
- Knowledge of data privacy principles and their application to AI training data, model outputs, and inference pipelines
- Strong understanding of cloud security principles and experience securing AI workloads in cloud environments (AWS, Azure, or GCP)
- Ability to translate complex AI security risks into clear, actionable guidance for both technical and non-technical audiences
- Strong analytical, problem-solving, and critical thinking skills
- Excellent written and verbal communication skills, including experience presenting to senior leadership and governance bodies
Preferred Job Qualifications- Master's degree in Cybersecurity, Health Informatics, Artificial Intelligence, Data Science, Information Systems, or a related discipline preferred.
- Experience in healthcare, academic medical centers, research environments, or similarly regulated industries strongly preferred.
- Industry-recognized security, risk, privacy, cloud, audit, or AI governance certification preferred, such as CISSP, CISM, CISA, CRISC, CSSLP, CCSP, GIAC, or equivalent.
- Experience with AI governance, model risk management, third-party AI risk, or secure AI lifecycle practices preferred.
- Familiarity with healthcare AI use cases, clinical decision-support systems, research AI platforms, generative AI tools, copilots, or vendor-supplied AI applications preferred.
