Principal Cybersecurity GRC Architect

Under the guidance of the Manager of Cybersecurity Legal Governance, Risk, and Compliance ("GRC"), the Principal Cybersecurity GRC Architect is instrumental in the identification and mitigation of cybersecurity risks across one of the largest academic health systems in Florida. Working collaboratively with the GRC assessment team and cross-functional stakeholders across the organization, this role is integral to assuring that our health system's information security aligns with industry standards and best practices. The Cybersecurity GRC Architect will manage risk and compliance assessments and audits, maintain a comprehensive risk register, design security architecture and controls, and oversee the remediation of identified risks. This position requires excellent communication skills to effectively collaborate with stakeholders and prioritize assessment findings and mitigations that assure compliance and maximize the organization's return on security investments compliance. Performs Job duties as assigned in accordance with mission, vision and values of Tampa General Hospital.

Essential Functions:

• Conduct and maintain comprehensive cybersecurity assessments using industry-standard frameworks such as NIST Cybersecurity Framework. Identify gaps, develop mitigation strategies and security architecture, and track remediation efforts to enhance the organization’s security posture.
• Oversee the ongoing management of HITRUST r2 certification requirements. Ensure continuous compliance with HITRUST controls, manage audit processes, and implement corrective actions to address identified deficiencies.
• Manage the organization’s HIPAA and HITECH compliance program. Lead robust annual assessments, maintain necessary documentation, communicate findings, develop security architecture and controls to address any gaps to ensure ongoing compliance requirements.
• Manage the organization’s Payment Card Industry Data Security Standard (PCI DSS) compliance program. Coordinate regular self-assessment questionnaires (SAQs), maintain necessary documentation, and address any gaps to ensure ongoing compliance with PCI DSS requirements.
• Maintain risk register that identifies and prioritizes cybersecurity risk scenarios. Use quantitative risk assessment methodologies to provide insights into potential financial and operational impacts of cyber risks.
• Lead the development, implementation, and maintenance of cybersecurity policies and procedures. Ensure alignment with industry regulations and frameworks, and support the organization’s security governance strategy.
• Coordinate and manage internal and external audits related to cybersecurity governance, risk, and compliance. Ensure that all findings are addressed promptly and effectively, and maintain audit documentation for regulatory purposes.
• Lead efforts to continuously improve the organization’s cybersecurity governance, risk management, and compliance processes. Monitor industry trends, emerging threats, and regulatory changes to ensure that the organization’s GRC strategy remains effective and up-to-date.
• Produce reports and communicate technical assessment findings and remediation strategies with senior leadership, auditors, and regulators regarding cybersecurity governance, risk, and compliance issues. Maintain reports and updates on compliance status, risk levels, and remediation progress.
• Manage the cybersecurity risk associated with third-party vendors and service providers. Ensure that all vendors meet the organization’s cybersecurity requirements and conduct regular assessments to identify and mitigate risks.
• Develop and implement a robust cybersecurity awareness training program, providing engaging in-person and virtual training tailored for clinical and administration team members.

• Bachelor’s Degree IT
• Bachelor’s Degree Computer Information Security
• Bachelor’s Degree Related Field

Licenses and Certifications:

• Certified Information Systems Security Professional (CISSP)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• Certified Governance Risk and Compliance (CGRC)
• Certified Compliance & Ethics Professional (CCEP)
• Certification in Risk Management Assurance (CRMA)
• Certified in the Governance of Enterprise IT (CGEIT)
• GRC Professional (GRCP)
• Project Management Institute — Risk Management Professional (PMI-RMP)
• Cybersecurity Analyst+ (CySA+)

Experience Qualifications:

• Minimum eleven (11) years of enterprise Cybersecurity Governance, Risk Management, and Compliance (GRC) experience.
• Certifications may be earned within 1 year of hire.
• An equivalent combination of education and years of experience.

Skills and Abilities:

• Expertise applying the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) in highly regulated enterprise environments
• Expertise managing Payment Card Industry Data Security Standard (PCI DSS) Compliance across multiple merchant IDs
• Expertise evaluating technical documentation (i.e. data flow diagrams) and threat modeling potential cybersecurity risks
• Expertise populating and maintaining cybersecurity risk registers in highly regulated enterprise environments
• Expertise architecting mitigating controls in complex hybrid (cloud and on-premises) environments
• Expertise with Health Information Trust Alliance (HITRUST) Cybersecurity Framework assessment and certification process
• Expertise with Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rule requirements and assurance procedures
• Expertise with Health Information Technology for Economic and Clinical Health (HITECH) requirements and assurance procedures
• Expertise applying the procedures found in the NIST 800-series, including NIST SP 800-53, SP 800-39, SP 800-37, SP 800-30, and SP 800-137
• Expertise conducting physical security risk assessments
• Expertise conducting Operational Technology / Internet of Things risk assessments
• Familiarity with the quantification of cybersecurity risks to communicate in terms of potential financial impact
• Expertise documenting cybersecurity policies, standards, and procedures in highly regulated enterprise environments
• Knowledge of the current and developing cybersecurity threat landscape and industry best practices
• Expertise producing risk assessment reporting that communicates findings and mitigation strategies for executive and technical audiences
• Excellent Analytical, conceptual, problem solving, and written/verbal communication skills