L3 Information Security Specialist

Title: Principal Information Security Specialist

Location: Philadelphia, PA (hybrid) - Mostly Remote with some onsite trips

Type: Contract

Our direct client is seeking a Principal Information Security Specialist who has technical, hands-on experience with information security project implementations and will serve as subject matter expert and in-house advisor on complex problems and issues. The ideal candidate has technical experience with security logging and security monitoring technology (i.e. security incident and event management technology, managed detection and response technology, etc.), Microsoft technology experience, experience working with Managed Security Service Providers (MSSPs) and Cloud providers, and experience with managing governance over security initiatives, such as security logging governance.

The Principal Information Security Specialist must be able to work independently and draw upon extensive professional knowledge and experience to make independent judgement regarding analysis, evaluation, development, and implementation of enterprise long-term solutions and operating initiatives. Excellent communication and documentation skills are a must.

The position is primarily remote; however, there is potential to come on site so local candidates highly preferred. Security certifications are preferred but not required.

Key Accountabilities:

• Works independently to initiate assignments and draws upon extensive professional knowledge and experience to make independent judgments regarding analysis, evaluation, development, and implementation of enterprise long-term solutions and operating initiatives to ensure that enterprise architectural objectives are aligned with organizational needs and strategic goals.
• Optimizes information management approaches through an understanding of evolving business needs and technology capabilities and ensures that projects do not duplicate functionality or diverge from each other and business and IT strategies.
• Shapes, designs, and plans specific service lines in product area and manages the risks associated with information and IT assets through appropriate standards and security policies.
• Functions as the subject matter expert (SME) to maintain an understanding of IS business and clinical applications and the relationship to InfoSec and compliance solutions; assists Hospital stakeholders in understanding information protection needs that support the Hospital's business.
• Works with other architects to provide a consensus-based enterprise solution that is scalable, adaptable and in synchronization with ever-changing business needs and takes ownership of a particular solution offering.
• Works with highly matrixed team of IS personnel to support enterprise architecture and information security operations including, but not limited to, architecture and InfoSec principles around identity and access management models, cloud identify management providers, security information and event monitoring, and data loss prevention, perimeter (e.g., firewalls, IPS, web filtering), cloud and virtualization environments, and network security (host-based firewalls, anti-virus, disk encryption).
• Supports and/or leads activities around InfoSec standards for business continuity and change management activities (e.g., table tops and change review board) and educates IS Hospital management on security issues (e.g., Identity and Access Management (IAM) and Role-Based Access Control (RBAC) models).
• Supports the integration of information security in the development, design, and implementation of Hospital Technology Resources that process, transmit, or store enterprise information.
• Supports all compliance activities related to state, federal regulatory requirements, healthcare accreditation standards, and all other applicable regulations that govern the use and disclosure of patient, financial, or other confidential information.

Required Skills:

• Bachelor's degree in Computer Science, Information Systems, or related field.
• At least twelve (12) years of industry-related experience, including experience in one to two IT disciplines (such as technical architecture, network management, application development, middleware, information analysis, database management, or operations) in a multitier environment.
• At least six (6) years of experience with information security, regulatory compliance and risk management concepts.
• At least three (3) years of experience with Identity and Access Management, user provisioning, Role-Based Access Control, or control self-assessment methodologies and security awareness training.
• Experience with Cloud and/or virtualization technologies.
• Comprehensive knowledge and understanding of Information Security principles, general and IT controls (e.g., access controls, risk management, change management, cloud security) and related information security policies and procedures.
• Knowledge of industry regulatory standards and accreditation requirements or control frameworks (HIPAA, PCI, Joint Commission, NIST, Red Flags, and ISO 27000 series).
• Comprehensive knowledge of information security regulations, standards and leading practices, including understanding of EHR, cloud frameworks, identity access controls.
• General understanding of networking and communication techniques including WANs, LANs, Internet, Intranet, protocols, such as TCP/IP and their impact on security.
• Experience with industry standard SDLC methodologies; hands-on experience in Project Server methodologies, PMO project management skills, including use of MS productivity tools (Access, Word, PowerPoint, Visio, and Project).
• Experience with risk management frameworks.
• Ability to understand and comply with all enterprise and IS departmental information security policies, procedures, and standards.
• Demonstrates specialized and comprehensive knowledge in Information Security management practices, disciplines, regulations, industry standards, related frameworks, project management principles and methodologies, security engineering concepts, security operations model, and industry standards around architecture principles.
• Exhibits the ability to plan, manage, and implement highly complex enterprise architecture and security implementations, enhancements, or modifications that require in-depth knowledge across multiple technical areas and business segments.
• Exhibits exceptional understanding of emerging regulatory and healthcare issues in order to develop internal and external checks and controls to ensure proper governance, security and quality of information assets.