About this role
Director of Information Security
The Director of Information Security leads and maintains the New York Genome Center’s (NYGC) information security program, including security governance, risk management, security operations, and incident response. The role protects clinical, research, and business information across enterprise systems, cloud services, and research environments. The Director establishes security policies, coordinates risk management and compliance activities, and leads incident response.
Working with executive leadership, IT, researchers, and external security providers, the Director investigates suspicious activity, maintains assigned security tools, coordinates remediation, and ensures security findings are documented and addressed. The position uses operational evidence and risk assessments to inform compliance activities, program improvements, and security priorities.
This position reports to the Senior Vice President of Informatics and serves as NYGC’s Information Security Officer. The Director is accountable for the overall security program, partnering with executive leadership, IT, researchers, legal, privacy, and operational stakeholders. The role establishes security priorities, recommends resource allocations, and communicates material risks and mitigation options to authorized organizational decision-makers.
Key Responsibilities
Security Program Leadership and Governance
Establish and maintain the enterprise security strategy, governance structure, multiyear roadmap and annual implementation plan aligned with NYGC’s mission, operational needs, and risk priorities.
Author, maintain, and coordinate approval of security policies, standards, and procedures. Establish processes for policy reviews, implementation, exceptions, and documented approvals.
Translate organizational priorities and risk assessments into security objectives, investment proposals, and measurable outcomes.
Lead security budget development proposals, resource plans, technology selection, and service-provider strategy.
Present security performance, material risks, resource needs, and strategic recommendations to executive leadership.
Enterprise Risk Management and Compliance
Establish the security risk assessment methodology, risk register, reporting structure, escalation criteria and remediation tracking.
Lead a security program aligned with the NIST Cybersecurity Framework, including current-state assessments, target-state planning, and prioritized improvement initiatives.
Integrate security risk reporting with organizational governance, budgeting, and planning.
Lead security activities supporting applicable HIPAA Security Rule compliance, in partnership with privacy, legal, compliance, and operational stakeholders.
Hold security audits, control assessments, evidence management, and corrective action programs.
Establish and manage third-party security risk management requirements and oversee significant vendor and contractual security reviews.
Evaluate security obligations associated with research funding, contracts, collaborations, and data-use agreements in partnership with responsible stakeholders.
Coordinate responses to external security questionnaires and requests for security assurance.
Present unresolved risks and treatment options to leadership and obtain documented decisions from authorized risk owners.
Security Operations and Technical Risk Oversight
Establish the security operating model, service expectations, escalation procedures, and performance measures.
Direct security monitoring, incident detection, vulnerability management, penetration testing, and remediation oversight.
Oversee external monitoring and response providers.
Establish security requirements for identity, privileged access, endpoints, networks, cloud services, logging, and sensitive data protection.
Evaluate significant technology and security architecture decisions and prioritize technical risk reduction initiatives.
Conduct security-tool selection, deployment, integration, maintenance, and effectiveness.
Establish accountability and escalation processes for persistent control gaps and overdue remediation.
Assess the effectiveness of security investments and direct improvements in operational coverage and capability.
Partner with IT and system owners to implement safeguards, address control gaps, and resolve overdue remediation.
Review proposed technologies and significant system changes for security risks and recommend appropriate controls.
Incident Leadership and Organizational Resilience
Own and maintain the incident response program, including plans, exercises, escalation criteria, and continuous improvement.
Lead coordination of security investigations, containment, recovery, and post-incident corrective actions.
Advise executives on incident impact, containment priorities, recovery risks, and resource requirements.
Coordinate with IT, legal, privacy, communications, operational leaders, and external responders as appropriate.
Partner with organizational leaders and system and business owners to establish security requirements for continuity, backup, and recovery capabilities.
Ensure incident findings and exercise results inform policy, operational improvements, and investment decisions.
Provide leadership during significant incidents outside normal business hours under established coverage arrangements.
Research Security Data Protection and Organizational Engagement
Integrate security requirements into major clinical, research, and technology initiatives.
Partner with scientific and operational leaders to protect sensitive data while supporting research and collaboration.
Establish consistent security review processes for research environments, external data sharing, and new partnerships.
Resolve cross-functional security priorities and communicate practical recommendations to organizational leaders.
Direct the security awareness program and establish targeted education for employees, researchers, and leadership.
Partner with researchers, clinical teams, and IT to protect sensitive information throughout its collection, use, storage, transfer, and disposal.
Establish security requirements for research computing, cloud environments, external collaborations, and data-sharing workflows.
Evaluate proposed research and clinical workflows and recommend practical safeguards.
Develop and oversee security awareness training, phishing education, and targeted guidance for specialized teams.
Communicate security requirements clearly and support their implementation across departments.
Required Qualifications
Bachelor’s degree in information security, computer science, or a related field, or equivalent relevant experience.
At least 10 years of progressively responsible information security experience, including at least 2 years leading security programs with responsibility for strategy, budgets, and executive reporting.
Demonstrated experience establishing or substantially improving an enterprise security program aligned with the NIST Cybersecurity Framework.
Demonstrated leadership across security risk management, incident response, vulnerability management, third-party risk, and security operations.
Experience establishing an organization-wide security policy framework and authoring policies, standards, and procedures.
Experience developing multiyear security roadmaps, managing budgets, and prioritizing investments based on risk and organizational needs.
Experience directing staff or service providers and leading cross-functional security initiatives.
Ability to advise executives and communicate technical risks, business consequences, and actionable recommendations.
CISSP, CISM, or a comparable certification demonstrating security leadership expertise.
Preferred Qualifications
Advanced degree in information security, computer science, business administration, or a related field.
Experience leading security in healthcare, genomics, academic research, or another environment handling sensitive clinical or research information.
Experience supporting federally funded research and interpreting security obligations in grants, contracts, sponsor requirements, or data-use agreements.
Experience leading implementation or assessment of controls drawn from NIST SP 800-53 or SP 800-171 where applicable.
Experience securing research computing, cloud environments, and external data-sharing arrangements.
Additional relevant credentials in risk management, auditing, cloud security, or incident response.
Com