Chief Information Security Officer

System Director, Information Security (CISO)

Salary range: $176,675- $265,000/year Relocation Assistance: This role offers in-state or out-of-state relocation assistance for candidates who have not worked at St. Charles Health System in the last year.

Reports To Position: SVP, Chief Information & Digital Officer

Department: Information Security

Date Last Reviewed: August 2026

Our Vision: Creating America's healthiest community, together.

Our Mission: In the spirit of love and compassion, better health, better care, better value

Our Values: Accountability, Caring and Teamwork

Department Summary: The St. Charles Health System's Information Security department identifies, assesses, reports, and helps to mitigate technical, physical, and administrative risks to St. Charles' regulated and confidential information.

Position Overview: The System Director Information Security (CISO) collaborates internally and externally to identify, assess, report, and help mitigate risks to St. Charles' physical and digital regulated and confidential information in alignment with business goals and objectives. This role leads the information security department and partners closely with IT, Privacy, Compliance, Internal Audit, HR, Legal, and other departments. The CISO develops strategy, policy, and oversees information security operations (e.g., network monitoring, threat intelligence, vulnerability management, penetration testing, data loss prevention, incident response, advisory services), third-party risk management, e-Discovery, information security risk management, awareness and education, program management, and governance. The CISO has demonstrated experience with the technical, administrative, and regulatory requirements and best practices relating to information security, privacy, and healthcare operations.

This position directly manages caregivers in the information security department.

Essential Functions and Duties:

Develops, implements, and oversees a strategic, enterprise-wide information security program to ensure the integrity, confidentiality, and availability of St. Charles' regulated and confidential information and systems.

Identifies, evaluates, and reports on information security risks in a manner that meets compliance and regulatory requirements and aligns with the organization's overall risk posture.

Establishes and facilitates information security governance through leadership and active participation in organizational governance bodies, including data governance, external data governance, technology governance, and safety governance committees.

Reports on the status of identified information security risks, provides regular updates on the evolving threat landscape, and secures executive approval for strategic initiatives to reduce St. Charles' risk exposure.

Develops, maintains, and publishes current information security policies, standards, procedures, and guidelines.

Oversees enterprise information security risk management and mitigation activities to ensure timely and effective remediation.

Collaborates with executive leadership to define acceptable levels of information security risk and ensures alignment with organizational objectives.

Partners with the System Privacy Officer to conduct risk assessments and evaluations related to HIPAA Privacy and Security Rule compliance and the Health Industry Cybersecurity Practices.

Establishes and oversees cybersecurity risk frameworks specifically governing Internet of Medical Things (IoMT) devices, clinical networks, and biomedical integration.

Drives the adoption and continuous maturity of enterprise security frameworks, aligning operations with the NIST Cybersecurity Framework (CSF), NIST AI Risk Management Framework, and HITRUST standards.

Leads and directs a dedicated technical security team responsible for executing the following core operational functions:

Security Operations & Incident Response (SOC):

• 24/7/365 security monitoring, threat hunting, log aggregation, and event correlation using SIEM/SOAR platforms.
• Rapid triage, containment, escalation, and post-incident root-cause analysis for security events across network, endpoint, and cloud environments.

Engineering & Architecture Implementation:

• Design, deployment, and ongoing administration of Endpoint Detection & Response (EDR/XDR).
• Identity & Access Management (IAM) technical oversight, including privileged access management (PAM), multi-factor authentication (MFA), and directory service security controls.

Vulnerability Management & Offensive Security:

• Continuous vulnerability scanning, patch verification, and risk-prioritized remediation tracking across clinical, enterprise, and infrastructure assets.
• Coordination and execution of internal/external penetration testing, red teaming exercises, and social engineering scenarios.

Data Loss Prevention (DLP) & Technical Privacy Controls:

• Configuration and management of DLP agents, email security gateways, encryption tools, and data classification mechanisms to safeguard Protected Health Information (PHI) and corporate data.
• Medical Device & Endpoint Security:
• Technical discovery, isolation, and security patching for biomedical equipment, Internet of Medical Things (IoMT) hardware, and clinical workstation configurations.

Designs, implements, and manages organization-wide information security awareness and training programs for employees, contractors, and authorized system users.

Works closely with business units to facilitate information security risk assessment and management processes, engaging stakeholders across the organization to identify and manage residual risk.

Coordinates with the architecture team members to ensure security controls and strategies are aligned with enterprise architecture and technology roadmaps.

Defines and oversees the information security risk assessment process, including internal reporting and governance of remediation efforts for identified findings.

Leads the organizational response to information security incidents and events to protect St. Charles' assets, intellectual property, regulated data, and organizational reputation.

Supports Human Resources, Legal, Compliance, and Privacy functions with internal investigations, regulatory inquiries, audits, and other investigative activities as required.

Monitors the external threat environment for emerging risks and vulnerabilities and advises executive leadership and stakeholders on appropriate response strategies.

Responsible for budget development, regular monitoring, accountability and meeting all operational targets for all areas within span of control.

Hires, directs, coaches, and monitors the performance of all direct reports, to develop and maintain a high-performance team that meets organizational and department goals.

Monitors and ensures all direct reports are current with compliance and safety requirements. Implements and manages all organizational safety directives and goals.

Provides and oversees team's delivery of customer service in a manner that promotes goodwill, is timely, efficient, and accurate.

Collaborates with teams to review processes and identify/implement opportunities for improvements, applying Lean principles, concepts, and tools.

Supports the vision, mission, and values of the organization in all respects.

Supports the Lean principles of continuous improvement with energy and enthusiasm, functioning as a champion of change.

Provides and maintains a safe environment for caregivers, patients, and guests.

Conducts all activities with the highest standards of professionalism and confidentiality. Complies with all applicable laws, regulations, policies, and procedures, supporting the organization's corporate integrity efforts by acting in an ethical and appropriate manner, reporting known or suspected violation of applicable rules, and cooperating fully with all organizational investigations and proceedings.

May perform additional duties of similar complexity within the organization, as required or assigned.

Education:

Required: Bachelor's degree in information technology, information security, or related field.

Preferred: Master's degree in a related field.

Licensure/Certification/Registration:

Required: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), or other similar credential(s).

Preferred: Multiple relevant industry certifications.

Experience:

Required: Minimum of seven (7) years of information security experience. Minimum of two (2) years leading and managing information security programs and leadership experience in a regulated environment (preferably healthcare).

Preferred Experience: Comprehensive cybersecurity leadership spanning technical operations, risk and compliance, governance and frameworks, privacy and regulation, cloud and emerging technologies.

Personal Protective Equipment:

Must be able to wear appropriate Personal Protective Equipment (PPE) required to perform the job safely.

Additional Position Information:

Travel: Must be able to travel to business functions/trainings/meetings and all SCHS worksites.

Physical Requirements:

Continually (75% or more): Use of clear and audible speaking voice and the ability to hear normal speech level.

Frequently (50%): Sitting, standing, walking, lifting 1-10 pounds, keyboard operation.

Occasionally (25%): Bending, climbing stairs, reaching overhead, carrying/pushing,