Surescripts serves the nation through simpler, trusted health intelligence sharing, in order to increase patient safety, lower costs and ensure quality care. We deliver insights at critical points of care for better decisions - from streamlining prior authorizations to delivering comprehensive medication histories to facilitating messages between providers.

Job Summary:

The Director, Threat Management helps carry out the strategy of a proactive information security program by leading through effective identification and mitigation of the cyber threats that are posed to the Surescripts network. The Director, Threat Management oversees the implementation and management of cutting-edge tools and methodologies to detect, analyze and respond to emerging threats in real-time. The Director, Threat Management leads the Blue Team (incident response) and the Red Team (internal penetration testing) along with the Manager, Threat management to identify vulnerabilities and suspicious activities before they escalate to critical incidents. This leader directs the Incident Response team in collaboration with the Crisis Management Team. The Director, Threat Management provides critical insights into global threats, trends, cybercrime tactics and potential attack vectors specific to the healthcare industry.

• Oversee and proactively coordinate the organization's cybersecurity efforts under the direction of the CISO
• Identify, respond to and mitigate cyber threats before they become critical incidents.
• Contain, mitigate and remediate incidents to ensure that the response times are minimized.
• Combine strategic vision with operational oversight to ensure the organization is adequately protected against a wide range of cyber threats.
• Manage overall cyber security risks as they pertain to Surescripts and its customers.
• Oversee the Threat Management operations:
  
  
  • Threat detection
  • Vulnerability Management
  • Insider Threat Detection
  • Data Loss Prevention
• Lead the Incident Response Teams:
  
  
  • Perform regular tabletop exercises
  • Ensure the right tools are leveraged for incident response
  • Ensure ongoing staff development
  • Collaborate with Legal and outside counsel as needed
  • Collaborate with outside incident response teams as needed
• Develop and maintain up-to-date Incident Response Plans
• Post incident reviews and root cause analysis in a centralized location for collaboration with key stakeholders
• Collaborate with cross-functional partners and external partners
• Evaluate and implement security technologies.
• Ensure regulatory compliance.
• Prepare for audits and reporting of the Threat Management Program
• Establish, monitor and report Threat Management program metrics and reporting.
• Develop staff skills and competencies. Identify training needs and opportunities
• Engage when needed for merger and acquisition activities to ensure risks are mitigated effectively.
• Lead a team of internal and external penetration testers to ensure proper application, internal and external penetration testing is scheduled to meet the needs of the business, information security compliance and contractual requirements.
• Ensure service provider contracts contain language acceptable to monitoring and enforcement across provided services and accessible data. 
• Focus on active threat monitoring while adhering to, and not overstepping, privacy requirements. 
• Baseline accounts and systems to identify deviation from expected behavior and investigate as required. 
• Plan and execute regular tabletop drills of Threat Management incident response and postmortem exercises with a focus on measurable improvement and benchmarking to show progress (or deficiencies requiring additional attention). 
• Develop metrics and scorecards to measure risk to the organization, as well as effectiveness and efficiency of threat analysts.  Manage career development for a team of analysts, including training and mentoring, conducting performance reviews and modeling behavior for team members.

• Bachelor's degree in computer science, information assurance, MIS or related field, or equivalent.
• 8-10+ years of information security administration, monitoring and response or related experience.  
• Experience managing a Threat Management program and leading technical teams. 
• Demonstrated business acumen. 
• Excellence in communicating business risk from cybersecurity topics. 
• Strong understanding and demonstrated use of best practices following NITTF, NIST and CERT guidance. 
• Proficient in driving measurable improvement in detection and response capabilities at scale. 
• Experience managing SIEM, UEBA, vulnerability management, data loss prevention (DLP), threat intelligence, MITRE ATT&CK framework mapping, security orchestration automation and response (SOAR), and other network and system monitoring tools.
• Experience supporting investigations using formal chain-of-custody methods, forensic tools and best practices. 
• Proficient in security analytics and threat data management. 
• Track record of acting with integrity, taking pride in work, seeking to excel, being curious and adaptable, and communicating well. 

• CISSP (preferred); CERT ITPM and/or ITVA (preferred or willing to obtain); SANS certification a plus.