Description

JOB DESCRIPTION

POSITION: INFORMATION TECHNOLOGY DIRECTOR

CLASSIFICATION CODE: EXEMPT FULL TIME

DEPARTMENT: INFORMATION TECHNOLOGY

REPORTS TO: CEO

STATEMENT OF JOB: The Information Technology (IT) Director provides executive-level leadership, strategic direction, and hands-on management for all aspects of Apache Behavioral Health Services' (ABHS) technology operations. This includes IT infrastructure, cybersecurity, data protection, vendor relationships, electronic health record (EHR) systems, and digital innovation initiatives. The IT Director ensures compliance with HIPAA Security Rules, federal (IHS), state (AHCCCS), and Tribal (638 contract) requirements, while supporting clinical, administrative, and operational excellence across multiple ABHS facilities on the Fort Apache Reservation. As both a strategic leader and a hands-on practitioner, the IT Director develops IT policies, oversees staff and vendors, manages complex projects, and directly engages in technical problem-solving to guarantee secure, efficient, and reliable IT systems that support ABHS's mission of providing behavioral health care to the White Mountain Apache Tribe.

DUTIES AND RESPONSIBILITIES:

Strategic Leadership & Governance

1. Serve as ABHS's senior technology executive, aligning IT strategy with agency mission, compliance requirements, and growth initiatives.
2. Develop and execute multi-year IT roadmaps covering infrastructure upgrades, cybersecurity maturity, cloud adoption, and digital innovation.
3. Lead the IT Steering Committee, advising the CEO and executive leadership team on technology investments, risk posture, and emerging solutions.
4. Develop, manage, and monitor the IT department budget in collaboration with Finance and the CEO, balancing cost control with innovation.
5. Represent ABHS in Tribal, state, and national IT consortiums, ensuring advocacy and access to shared resources.
6. Establish and enforce IT governance, including change management, technology standards, and agency-wide compliance policies.
7. Provide regular IT performance, risk, and compliance reporting to the CEO, Board of Directors, and regulatory agencies.

Cybersecurity & Compliance Oversight

1. Serve as Chief Information Security Officer (CISO) for ABHS, ensuring compliance with HIPAA, IHS, AHCCCS, and Tribal IT security requirements.
2. Lead enterprise-wide security frameworks, including NIST CSF and CIS controls, adapting to the needs of healthcare and behavioral health environments.
3. Direct incident response, breach investigations, and forensic activities in coordination with Tribal, state, and federal partners.
4. Oversee risk assessments, penetration testing, and vulnerability management programs; ensure timely remediation.
5. Ensure encryption, MFA, endpoint protection, mobile device management, and secure cloud practices are enforced across ABHS.
6. Maintain compliance with cybersecurity insurance requirements and support audits by insurers, regulators, and external entities.
7. Develop and maintain ABHS's Information Security Program Manual and Business Continuity/Disaster Recovery (BC/DR) plans.
8. Supervise data governance, data loss prevention (DLP), and secure data exchange practices across all platforms.
9. Ensure Business Associate Agreements (BAAs) and vendor security reviews are current and enforceable.

IT Operations & Infrastructure

1. Oversee day-to-day IT operations for all ABHS facilities, including clinics, shelters, residential facilities, and administrative offices.
2. Provide hands-on technical leadership for infrastructure management, including servers, storage, networks, VoIP, firewalls, and wireless systems.
3. Ensure continuous uptime and secure operation of ABHS's EHR (myEvolv), HRIS, and financial systems.
4. Lead agency-wide cloud strategy, optimizing Microsoft 365, Azure AD, Teams, SharePoint, OneDrive, and hybrid integrations.
5. Direct system monitoring, patch management, and lifecycle refresh planning for hardware, software, and network devices.
6. Maintain centralized configuration management, CMDB accuracy, and IT asset inventory.
7. Ensure effective vendor and managed services coordination for mission-critical infrastructure projects.
8. Lead IT support for telehealth platforms, remote staff, and hybrid work environments.
9. Oversee agency-wide audiovisual and conferencing systems for clinical and administrative use.
10. Personally intervene in escalated IT support issues, providing direct technical expertise.

Vendor & Project Management

1. Negotiate contracts, SLAs, and renewals with technology vendors, MSPs, and cloud providers.
2. Direct IT capital projects (network upgrades, cloud migrations, cybersecurity implementations), ensuring timelines, budgets, and compliance.
3. Enforce vendor compliance with HIPAA, Tribal, and ABHS standards through BAAs and ongoing audits.
4. Oversee vendor risk assessments and remediation for third-party hosted systems.
5. Ensure knowledge transfer from vendors to internal staff upon project completion.
6. Manage procurement and licensing compliance for agency-wide hardware and software.

Staff Development & Leadership

1. Provide mentorship, professional development, and performance oversight for IT staff, fostering a culture of accountability and service.
2. Ensure adequate IT staffing coverage for multi-site operations, after-hours support, and emergency response.
3. Lead annual security awareness and phishing simulation training for all ABHS employees.
4. Model hands-on leadership by actively participating in troubleshooting, system deployments, and complex IT challenges.
5. Develop succession planning and career pathways for IT personnel to promote growth and retention.

Communication & Stakeholder Engagement

1. Serve as IT liaison to Tribal government, IHS, AHCCCS, and external regulators.
2. Communicate IT strategies, risks, and initiatives in accessible language for staff, leadership, and community stakeholders.
3. Support all Board and executive meetings requiring IT, audiovisual, or cybersecurity support.
4. Maintain culturally competent and professional relationships with Tribal leaders, community members, and external partners.

QUALIFICATIONS

Required:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field.
• Minimum ten (10) years of progressive IT experience, with at least five (5) years in senior leadership roles.
• Demonstrated experience managing IT operations across multi-site, healthcare, or behavioral health environments.
• Advanced technical knowledge of:
  • Microsoft 365, Azure AD, Teams, SharePoint
  • Windows Server (2016/2019/2022), virtualization, and cloud services
  • HIPAA compliance, NIST CSF, CIS benchmarks
  • Firewalls, networking, endpoint security, patch management
• Strong leadership, vendor negotiation, and project management skills.
• Valid Arizona driver's license and reliable transportation.
• Ability to pass fingerprint clearance, background checks, and pre-employment testing.

Preferred:

• Master's degree in Information Technology, Cybersecurity, or Business Administration.
• Professional certifications: CISSP, CISM, CompTIA Security+, Microsoft Certified Azure Administrator/Architect, or PMP.
• Experience in Tribal health, behavioral health, or federal contract-based IT environments.

1. Provide leadership for ABHS' overall IT strategy, infrastructure management, cybersecurity posture, and operational excellence.
2. Supervise all internal IT staff, including IT Supervisors, Specialists, and Helpdesk teams.
3. Manage contracts and relationships with outsourced IT partners (Managed Services Providers) and technology vendors.
4. Develop and monitor the annual IT budget in collaboration with the CEO and Finance.
5. Advise executive leadership on technology solutions aligned to agency growth, compliance, and operational needs.
6. Lead IT participation in strategic agency initiatives, including expansions, facility upgrades, and telehealth deployments.
7. Coordinate IT operations across all ABHS offices, residential facilities, field operations, and remote environments.
8. Lead IT Disaster Recovery and Business Continuity Planning (DR/BCP), ensuring resiliency of critical systems including EHR, finance, and HRIS platforms.
9. Oversee cybersecurity compliance programs, including HIPAA Security Rule adherence, risk analysis, and security incident response.
10. Develop long-term IT infrastructure and systems upgrade roadmaps, ensuring secure and scalable solutions.
11. Develop annual IT goals and objectives aligned to ABHS's strategic plan and report progress quarterly to executive leadership.
12. Maintain and enforce policies regarding appropriate use of agency technology and internet resources.
13. Lead or assist with investigations of technology misuse, security breaches, or compliance violations.
14. Design, implement, and test backup, replication, and disaster recovery systems to protect agency data.
15. Approve standard operating environments (SOEs) for endpoint device imaging and deployment.
16. Manage onboarding/offboarding technology processes to ensure secure access and data protection.
17. Coordinate periodic HIPAA Security Risk Assessments and ensure timely completion of corrective actions.
18. Ensure configuration management database (CMDB) accuracy and oversee IT asset audits.
19. Lead annual network penetration testing with third-party vendors and implement remediation plans.
20. Supervise IT helpdesk knowledgebase development to ensure consistent, accurate, and timely technical support.
21. Maintain up-to-date documentation of IT infrastructure, systems architecture, and vendor configurations.
22. Prepare technology investment proposals for leadership and Board approval, providing cost-benefit analyses and security implications.
23. Coordinate quarterly IT steering committee meetings involving senior leadership and department heads.
24. Lead annual IT staff security awareness training and phishing simulations.
25. Manage email security gateway and filtering systems to protect against spam, phishing, and malware threats.
26. Oversee the protection of mobile devices, including laptops and phones, using MDM solutions.
27. Ensure secure remote access technologies (VPN, MFA) are fully operational and monitored.
28. Supervise agency data loss prevention (DLP) efforts across email, network, and storage environments.
29. Maintain oversight of electronic health record (EHR) data security, access control, and user activity monitoring.
30. Develop and test business continuity procedures for mission-critical services, including EHR and telehealth platforms.
31. Participate in crisis response teams to support operational technology continuity during emergencies.
32. Coordinate software development or customization projects supporting agency operations or reporting needs.
33. Ensure compliance with federal, state, and Tribal regulations related to electronic records, privacy, and security.
34. Supervise user rights reviews to ensure staff have minimum necessary access under HIPAA Privacy Rule standards.
35. Manage centralized log collection, retention, and monitoring processes for audit and compliance reporting.
36. Facilitate annual hardware refresh planning to replace aging systems proactively.
37. Participate in external technology consortiums or Tribal IT networks to share knowledge and resources.
38. Create and maintain IT service catalogs for internal stakeholders, clearly outlining available services and support channels.
39. Collaborate with Facilities Department regarding physical security systems, including badge access and video surveillance integration.

CYBERSECURITY & COMPLIANCE:

1. Serve as lead to the Information Security Officer (ISO), ensuring implementation of cybersecurity frameworks and agency security policies.
2. Manage HIPAA compliance related to technology systems, including annual security risk assessments and mitigation activities.
3. Oversee endpoint protection, encryption, multifactor authentication (MFA), patch management, and network security monitoring.
4. Coordinate regular IT security audits, vulnerability assessments, and penetration testing with external providers.
5. Ensure accurate tracking and reporting of PHI security incidents and breaches in compliance with HIPAA regulations.
6. Implement cybersecurity awareness training programs for all ABHS employees.
7. Ensure continuous compliance with the HIPAA Security Rule across all technology systems.
8. Implement and enforce encryption at rest and in transit for all sensitive agency data.
9. Conduct quarterly security awareness training for all employees, covering phishing, password management, and data handling.
10. Ensure agency compliance with National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) controls where applicable.
11. Manage and monitor endpoint detection and response (EDR) or extended detection and response (XDR) solutions across the network.
12. Ensure multi-factor authentication (MFA) is enforced for all systems accessing PHI and financial data.
13. Perform role-based access control (RBAC) reviews quarterly, ensuring minimum necessary access levels.
14. Manage Secure File Transfer Protocol (SFTP) systems or equivalent for sensitive data exchanges.
15. Enforce patch management policies to remediate vulnerabilities within defined timelines based on criticality.
16. Maintain full asset inventory for IT hardware and software per HIPAA and cybersecurity insurance requirements.
17. Ensure that Electronic Health Record (EHR) audit logs are active, maintained, and reviewed as required.
18. Manage and test secure data backup and recovery protocols with offsite or cloud-based storage redundancy.
19. Maintain and review vendor risk assessments to ensure third-party compliance with security standards.
20. Supervise the application of Data Loss Prevention (DLP) technologies to prevent unauthorized data exfiltration.
21. Require encrypted email transmission for all PHI and sensitive data communications.