Manager of Cybersecurity Legal Governance, Risk, and Compliance ("GRC")

Under the direction of the Deputy Chief Information Security Officer, the Manager of Cybersecurity Legal Governance, Risk, and Compliance ("GRC") is instrumental in the identification and mitigation of information security risks at Tampa General Hospital (TGH) and partner organizations, responsible for collaborating with stakeholders across the organization and performing tasks critical to the Cybersecurity GRC Program. This position requires excellent communication skills, with the ability to engage effectively with a wide range of stakeholders, and a keen attention to detail with the ability to review complex legal and technical documentation. This role is crucial to the organization's cybersecurity posture and risk management efforts. Performs Job duties as assigned in accordance with mission, vision and values of Tampa General Hospital.

Essential Functions:

• Supervise and manage five key GRC elements: vendor risk management, compliance/audits, governance & training, data protection, and enterprise risk management.
• Supervise and manage the cybersecurity risk associated with third-party vendors and service providers. Ensure that the organization’s cybersecurity requirements are updated as appropriate and communicated internally and externally to third-party vendors and service providers.
• Supervise comprehensive cybersecurity assessments using industry-standard frameworks, eg NIST CSF.
• Supervise maintenance of HITRUST certification.
• Supervise the organization’s HIPAA and HITECH compliance program. Support team through annual assessments, communication of findings, and development of controls and/or security architecture to ensure ongoing compliance.
• Supervise the organization’s Payment Card Industry Data Security Standard (PCI DSS) compliance program.
• Supervise creation and maintenance of risk register that identifies and prioritizes cybersecurity risk scenarios. Educate business leaders re quantitative risk assessment methodologies to provide insights into potential financial and operational impacts of cyber risks.
• Manage the development, implementation, and evolution of cybersecurity policies and procedures. Ensure alignment with industry regulations and frameworks, and support the organization’s security governance strategy.
• Supervise internal and external audits related to cybersecurity governance, risk, and compliance. Communicate with business leaders as needed to educate and support such audits.
• Manage efforts to continuously improve the organization’s cybersecurity governance, risk management, and compliance processes. Monitor industry trends, emerging threats, and regulatory changes to ensure that the organization’s GRC strategy remains effective and up-to-date.
• Create reports and communicate technical assessment findings and remediation strategies with senior leadership, auditors, and regulators regarding cybersecurity governance, risk, and compliance issues. Review team reports and updates on compliance status, risk levels, and remediation progress.
• Manage development and implementation of a robust cybersecurity awareness training program, providing engaging in-person and virtual training tailored for clinical and administration team members.
• Drive compliance efforts aimed at reducing and mitigating cyber risks.
• Provide strategic guidance on new products and services as relating to cybersecurity legal risks.
• Leverage business relationships to guide decision makers toward solutions that balance business needs while mitigating risk.
• Streamline and update processes and procedures to increase efficiency and compliance.
• Supervise e-discovery process and procedures.
• Manage and support team in alignment with TGH Core Values.
• Maintain awareness of new cybersecurity threats, regulations, guidance, best practices, etc.
• Identify and advocate for tools and resources the team needs to excel in their work.
• Support team members' career development and goals.
• Manage enterprise risk management program.
• Supervise data protection program.
• Maintain budget for GRC team.
• Pursue Collaborative High Reliability Training.
• Develop and implement contract standards and processes that align with industry best practices and cybersecurity frameworks to enhance cybersecurity risk mitigation and regulatory compliance.

Education Qualifications:

• Bachelor’s Degree IT
• Bachelor’s Degree Computer Information Security
• Bachelor’s Degree Related Field

Licenses and Certifications:

• Certified Information Systems Security Professional (CISSP)
• GIAC Law of Data Security & Investigations
• Certified Information Privacy Professional (CIPP)
• Certified in Risk and Information Systems Control (CRISC)

Experience Qualifications:

• Minimum 8 years of professional experience working in or adjacent to Information Technology and Cybersecurity, including IT Vendor Contracting/Vendor Management, Compliance, Legal, and/or Audit.
• Certification may be earned within 1 year of hire.
• An equivalent combination of education and years of experience.

Skills and Abilities:

• Knowledge of the current and developing cybersecurity threat landscape and industry best practices.
• Understanding of and experience with cybersecurity and compliance laws, regulations, frameworks and certifications, including NIST CSF, HITRUST, HITECH, and PCI DSS.
• Experience with creation and management of risk registers in highly regulated enterprise environments.
• Ability to manage and oversee audits and risk assessments.
• Deep understanding of Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rule.
• Knowledge of incident and breach management laws, regulations and techniques, and data loss prevention.
• Understanding of cloud technology, SaaS environments, and legal, regulatory, and ethical aspects associated with automated decision-making and machine learning.
• Strong judgement and ability to engender trust.
• Familiarity with the quantification of cybersecurity risks to communicate in terms of potential financial impact.
• Expertise documenting cybersecurity policies, standards, and procedures in highly regulated enterprise environments.
• Knowledge of the current and developing cybersecurity threat landscape and industry best practices.
• Expertise producing risk assessment reporting that communicates findings and mitigation strategies for executive and technical audiences.
• Excellent Analytical, conceptual, problem solving, and written/verbal communication skills.
• Demonstrated ability to establish strong relationships with people at all levels within and outside of the organization.
• Ability to manage a large matter load of varying complexity and to work efficiently and productively.
• Expertise with streamlining and updating work processes to increase efficiency.
• Demonstrated ability to understand complex legal and/or cybersecurity requirements/statutes/frameworks/etc and translate for different audiences.
• Excellent analytical, organizational, written, and verbal communication skills.
• Expertise crafting and negotiating cybersecurity contractual provisions, business associate agreements, and data protection agreements.