The Enterprise Security Architect designs and maintains the security architecture supporting a multi-state post-acute health system. This position develops security standards and reference architectures, performs architecture and design reviews for enterprise and clinical technology initiatives, conducts threat modeling, and serves as the senior security subject matter expert to information technology, clinical, and business teams. The Enterprise Security Architect works closely with Information Technology, Network Operations, Clinical Informatics, Compliance, and third-party security providers to ensure security is designed into systems that support patient care.

Remote position with travel up to 15 percent to facilities across the enterprise. Facility visits occur in operating clinical environments and may require compliance with facility access, screening, and health requirements. Work is generally performed indoors in well-lighted, well-ventilated areas, with potential exposure to hospital clinical surroundings during visits. The position may be required to support significant security incidents outside standard business hours.

I. Position Responsibilities

· Develop, maintain, and govern PAM Health’s enterprise security architecture, technical security standards, design patterns, and reference architectures.

· Review enterprise, cloud, clinical, network, application, data, artificial intelligence, and medical device initiatives to ensure security requirements are incorporated before implementation.

· Conduct threat modeling and security design reviews for new systems, major changes, integrations, and third-party solutions.

· Define security requirements and architecture guardrails aligned with the NIST Cybersecurity Framework, HIPAA Security Rule, MITRE ATT&CK, OWASP guidance, and applicable regulatory requirements.

· Identify architectural risks, document required controls, recommend remediation, and communicate business and clinical impact to technical and executive stakeholders.

· Establish secure cloud, identity, network, endpoint, application, data protection, logging, monitoring, and incident response design standards.

· Partner with Information Technology, Network Operations, Clinical Informatics, Compliance, Privacy, Legal, and business leaders to integrate security into technology strategy and project delivery.

· Provide technical direction and oversight to managed security service providers, technology vendors, consultants, and other third parties.

· Support application security through secure development requirements, architecture reviews, vulnerability management, penetration testing, and remediation guidance.

· Evaluate the security of artificial intelligence and machine learning systems, including data protection, access control, model risk, third-party dependencies, and misuse scenarios.

· Assess medical devices and connected clinical technologies for cybersecurity risk and recommend compensating controls when remediation is limited.

· Support security incidents by providing architecture analysis, containment guidance, root-cause review, and recommendations to prevent recurrence.

· Maintain current knowledge of emerging threats, security technologies, healthcare cybersecurity requirements, and industry practices.

· Mentor security and information technology staff and promote consistent application of PAM Health security standards across the enterprise.

II. Leadership

· Inclusiveness: Promotes cooperation, fairness and equity; shows respect for people and their differences; works to understand perspectives of others; demonstrates empathy; brings out the best in others and in his/her team

· Managing Staff: Coaches, evaluates, develops, and inspires staff; sets expectations; recognizes achievements

· Stewardship and Resource Management: Demonstrates accountability and sound judgment in managing company resources; appropriate understanding of confidentiality and company values; adheres to and supports company policies, procedures and safety guidelines

· Problem-Solving: Identifies problems and involves others in seeking solutions; conducts appropriate analysis and searches for best solutions; effectively and efficiently implements appropriate responses to correct problems; responds promptly and effectively to new challenges

· Decision-Making: Makes clear, consistent decisions; acts with integrity in all decisions; distinguishes relevant from irrelevant information; makes timely, appropriate decisions.

· Strategic Planning and Organizing: Understands company vision and aligns priorities accordingly; measures outcomes; uses feedback to redirect as required; evaluates alternatives; appropriately organizes complex issues to desirable resolution

· Communication: Connects with peers, subordinate employees and all customers; actively listens; clearly and effectively shares information; demonstrates effective oral and written communication skills; negotiates effectively.

· Quality Improvement: Strives for efficient, effective, high-quality performance in self and in the department; delivers timely and accurate results; resilient when responding to matters that are challenging; takes initiative to make improvements

· Leadership: Motivates others; accepts responsibility; maintains high morale in department; develops trust and credibility; expects honest and ethical behavior of self and staff

· Teamwork: Encourages cooperation and collaboration; builds effective teams; works in partnership with others; is flexible; responsive to the needs of others

· Development: Maintains up-to-date skills through involvement with professional organizations and/or continuing education

II. Customer Service

· Maintains the highest level of customer service via courtesy, compassion and positive communication.

· Promotes the mission and vision of PAM Health within the work environment and the community.

· Respects dignity and confidentiality by adherence to all applicable policies and procedures.

III. Health and Safety

· Works in a manner that promotes safety; wears clothing appropriate to the performance of the job.

· Participates in OSHA required training.

· Follows universal precautions as appropriate for position; complies with Employee Health requirements for continued employment.

· Reports unsafe practices to management.

· Knows own role in case of an emergency.

Education and Training:

· Required: Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related technical field, or an equivalent combination of education and experience.

· Required Certification: Certified Information Systems Security Professional (CISSP) must be obtained within six (6) months of hire and maintained in good standing.

· Preferred: Master’s degree in Computer Science, Cybersecurity, or a related technical field.

· Preferred Certifications: GIAC Defensible Security Architecture (GDSA), SABSA, Certified Cloud Security Professional (CCSP), Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN), or HealthCare Information Security and Privacy Practitioner (HCISPP).

Experience:

Required:

· Ten (10) years of progressive experience in cybersecurity.

· Seven (7) years of cybersecurity experience in healthcare, including provider, health system, or comparably regulated clinical environments.

· Five (5) years in a security architecture or senior technical role.

· Three (3) years of application security experience.

· Experience providing technical direction to third-party security providers and managed security service providers.

Preferred:

· Medical device and connected clinical device security experience.

· Offensive security experience, including penetration testing, red team operations, or adversarial design review.

· Applied experience securing artificial intelligence and machine learning systems.

· Experience supporting HITRUST certification, SOC 2 Type II examination, ISO 27001 certification, or a comparable third-party assessment.

· Experience with 42 CFR Part 2, PCI DSS, and United States Food and Drug Administration software-as-a-medical-device requirements.

· Experience in geographically distributed, multi-facility clinical environments.

Knowledge, Skills, and Abilities:

· Demonstrated expertise with the OWASP Top 10 and secure development practices.

· Working knowledge of MITRE ATT&CK, the NIST Cybersecurity Framework, and the HIPAA Security Rule.

· Ability to translate technical risk into business and clinical impact for executive and clinical audiences.

· Strong written and verbal communication skills; ability to produce highly technical architectural documentation and present complex concepts to non-technical executive leadership.

· Familiarity with the OWASP Top 10 for Large Language Model Applications, the NIST Artificial Intelligence Risk Management Framework, and MITRE ATLAS preferred.

· Cloud security architecture experience across multiple cloud service providers preferred.