The Cybersecurity Program Manager leads enterprise cybersecurity programs that protect PAM Health, enable business operations, and support patient care. This position manages security technology initiatives, vendor performance, security awareness, incident response program maturity, metrics, executive reporting, and cross-functional delivery. The Cybersecurity Program Manager works with Information Technology, Infrastructure, Support, Clinical Informatics, Compliance, Privacy, Legal, managed service providers, and other business partners to implement security solutions effectively while managing operational risk.

I. Position Responsibilities

· Lead the planning, implementation, and continuous improvement of enterprise cybersecurity programs and security technology initiatives.

· Coordinate security deployments with Infrastructure, Support, managed service providers, application teams, and business stakeholders to achieve security objectives without unnecessary operational disruption.

· Evaluate security solutions for suitability, effectiveness, risk, operational impact, and alignment with PAM Health requirements.

· Develop phased implementation plans, project milestones, dependencies, risk controls, communications, and success measures for cybersecurity initiatives.

· Identify significant security and operational risks, recommend appropriate controls, and escalate decisions requiring executive direction.

· Manage security vendor relationships, service delivery, performance reviews, remediation commitments, and accountability.

· Monitor contracts, service-level agreements, performance metrics, outages, corrective actions, and the value delivered by security providers.

· Coordinate vendor incident response, root-cause analysis, post-incident reviews, remediation plans, and contractual follow-up.

· Lead and expand PAM Health’s cybersecurity awareness program, including employee education, phishing awareness, and recurring communications.

· Develop security metrics, dashboards, status reports, risk summaries, and executive-level communications.

· Formalize and improve cybersecurity program processes, including incident response, governance, documentation, and cross-functional coordination.

· Build productive relationships between Cybersecurity and technical, clinical, and business teams; translate business needs into secure, practical solutions.

· Maintain a forward-looking view of the security technology portfolio and recommend when solutions should be enhanced, replaced, consolidated, or retired.

· Support broader technology and organizational planning and provide cybersecurity leadership when significant issues require coordinated action.

II. Leadership

· Inclusiveness: Promotes cooperation, fairness and equity; shows respect for people and their differences; works to understand perspectives of others; demonstrates empathy; brings out the best in others and in his/her team

· Managing Staff: Coaches, evaluates, develops, and inspires staff; sets expectations; recognizes achievements

· Stewardship and Resource Management: Demonstrates accountability and sound judgment in managing company resources; appropriate understanding of confidentiality and company values; adheres to and supports company policies, procedures and safety guidelines

· Problem-Solving: Identifies problems and involves others in seeking solutions; conducts appropriate analysis and searches for best solutions; effectively and efficiently implements appropriate responses to correct problems; responds promptly and effectively to new challenges

· Decision-Making: Makes clear, consistent decisions; acts with integrity in all decisions; distinguishes relevant from irrelevant information; makes timely, appropriate decisions.

· Strategic Planning and Organizing: Understands company vision and aligns priorities accordingly; measures outcomes; uses feedback to redirect as required; evaluates alternatives; appropriately organizes complex issues to desirable resolution

· Communication: Connects with peers, subordinate employees and all customers; actively listens; clearly and effectively shares information; demonstrates effective oral and written communication skills; negotiates effectively.

· Quality Improvement: Strives for efficient, effective, high-quality performance in self and in the department; delivers timely and accurate results; resilient when responding to matters that are challenging; takes initiative to make improvements

· Leadership: Motivates others; accepts responsibility; maintains high morale in department; develops trust and credibility; expects honest and ethical behavior of self and staff

· Teamwork: Encourages cooperation and collaboration; builds effective teams; works in partnership with others; is flexible; responsive to the needs of others

· Development: Maintains up-to-date skills through involvement with professional organizations and/or continuing education

II. Customer Service

· Maintains the highest level of customer service via courtesy, compassion and positive communication.

· Promotes the mission and vision of PAM Health within the work environment and the community.

· Respects dignity and confidentiality by adherence to all applicable policies and procedures.

III. Health and Safety

· Works in a manner that promotes safety; wears clothing appropriate to the performance of the job.

· Participates in OSHA required training.

· Follows universal precautions as appropriate for position; complies with Employee Health requirements for continued employment.

· Reports unsafe practices to management.

· Knows own role in case of an emergency.

Education and Training:

· Required: Bachelor’s degree in Cybersecurity, Information Technology, Information Systems, Business Administration, Project Management, or a related field, or an equivalent combination of education and experience.

· Preferred: Master’s degree in Cybersecurity, Information Technology, Business Administration, or a related field.

· Preferred Certifications: Project Management Professional (PMP), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or comparable cybersecurity, program management, or vendor management certification.

Experience:

Required:

· Ten (10) years of progressive information technology experience, including at least five (5) years in cybersecurity.

· Three (3) years leading cybersecurity programs, enterprise technology initiatives, or comparable cross-functional projects.

· Experience managing security vendors, service providers, contracts, service-level agreements, performance metrics, and remediation commitments.

· Experience coordinating enterprise security technology deployments across infrastructure, endpoint, network, application, and business teams.

· Experience creating security awareness communications, program metrics, and executive-level reports.

Preferred:

· Cybersecurity experience in healthcare, a health system, or another regulated environment.

· Experience building or maturing cybersecurity awareness, incident response, governance, metrics, or vendor management programs.

· Experience supporting a geographically distributed, multi-facility organization.

· Prior infrastructure, networking, support, systems, or application experience that supports practical evaluation of operational impact.

Knowledge, Skills, and Abilities:

· Strong program and project management skills, including planning, prioritization, dependency management, risk tracking, and delivery oversight.

· Ability to evaluate cybersecurity technologies and services for effectiveness, operational impact, business fit, and risk.

· Knowledge of security operations, incident response, security awareness, vendor management, enterprise infrastructure, and common cybersecurity controls.

· Ability to translate technical and security risk into clear business impact, recommendations, and decisions for executive and non-technical audiences.

· Strong written and verbal communication, negotiation, relationship management, and cross-functional leadership skills.

· Sound judgment, accountability, initiative, and the ability to lead through influence while balancing security requirements with operational needs.

PHYSICAL DEMANDS: See attached Job Activity Requirements

WORKING CONDITIONS: Remote position with travel up to 15 percent to facilities across the enterprise. Facility visits occur in operating clinical environments and may require compliance with facility access, screening, and health requirements. Work is generally performed indoors in well-lighted, well-ventilated areas, with potential exposure to hospital clinical surroundings during visits. The position may be required to coordinate response to significant security incidents outside standard business hours.

ORGANIZATIONAL DATA: This is an exempt position, supervised by the Chief Information Security Officer. No formal line of promotion exists.