Manager, Information Security

Company Summary:

To achieve and maintain our high-quality standards, we see to partner with physicians and staff who share our vision, values and brand promises and are dedicated to advancing our culture. QualDerm providers and staff are well-trained, highly skilled and recognized as leaders in the specialty of dermatology.

We currently have 158 practices in 17 states, spanning across the full spectrum of dermatology, skin cancer care, cosmetics, plastic surgery, and pathology with continued plans to expand further across the nation.

We will partner with you to establish the best combination of environment, technology, teamwork and personal reward opportunities to earn your confidence that we are your best place to work.

Purpose:

Our organization operates a network of healthcare facilities and is investing in building out a mature, right-sized information security program to protect patient data, clinical operations, and business systems across all sites. We are seeking a Manager, Information Security to own the company's overall security posture end-to-end.

This is a hands-on, builder-oriented role, not a purely governance or policy-writing position. The ideal candidate has personally implemented security programs and controls, as a security architect, security engineer, or similar, and is comfortable being both the strategist setting direction and the practitioner in the tools day to day. You will partner closely with the Director, IT Infrastructure & Cloud, Director – Applications, and Data Analytics teams to ensure security is embedded into infrastructure, cloud (Azure), network, and endpoint architecture, while independently owning the company's overall security strategy, governance, and risk posture.

Essential Duties and Responsibilities:

Security Strategy & Program Ownership

• Own and evolve the company's overall information security strategy, roadmap, and maturity model, appropriately scoped for the size of the company.
• Act as the organization's senior-most day-to-day security leader, briefing leadership on risk posture, incidents, and program progress.
• Define, track, and report on security KPIs/metrics (risk reduction, vulnerability remediation SLAs, incident response times, control coverage).
• Build and manage the information security tooling, staffing, and third-party assessments.

Hands-On Security Architecture & Engineering

• Personally design and implement security architecture across identity, network, endpoint, cloud (Azure), and application layers; this is a working leader role, not purely oversight.
• Own the technical implementation and tuning of core security tooling: SIEM/SOAR, EDR/XDR, vulnerability management, email security, DLP, CASB, and identity/access management (Azure AD/Entra ID, PAM, MFA/conditional access).
• Design and enforce network and cloud security architecture in partnership with the Director, IT Infrastructure & Cloud (segmentation, firewall/NGFW policy, cloud security posture management).
• Lead vulnerability management and penetration testing programs, driving remediation across infrastructure, application, and data teams.

Governance, Risk & Compliance

• Own the organization's compliance posture for HIPAA, and applicable state/federal security regulations.
• Conduct and maintain enterprise risk assessments, third-party/vendor security risk reviews, and business associate agreement (BAA) security requirements.
• Develop, maintain, and test incident response, disaster recovery, and business continuity plans; lead tabletop exercises.
• Serve as key point of contact for security audits, regulatory inquiries, and cyber insurance underwriting/renewals.
• Incident Response & Threat Management
• Lead detection, response, and remediation for security incidents, coordinating with IT Infrastructure, clinical operations, legal, and external forensics/counsel as needed.
• Own threat intelligence monitoring and proactive threat hunting to identify risk before it becomes an incident.
• Maintain and continuously improve the security monitoring and alerting environment (SIEM use cases, detection engineering).

Security Awareness & Culture

• Design and lead the company-wide security awareness and phishing simulation program partnering with training team, across all sites.
• Partner with HR, Compliance, and clinical leadership to embed security practices into onboarding, training, and day-to-day workflows.
• Build positive, collaborative relationships with IT, clinical, and business stakeholders to drive security adoption without becoming a bottleneck to operations.

Cross-Functional Partnership

• Partner closely with the Director, IT Infrastructure & Cloud on all infrastructure, network, and cloud initiatives (Azure migrations, de-novo site launches, M&A integrations) to ensure security is designed in from the start, not bolted on afterward.
• Participate in technical due diligence and security risk assessment for M&A activity and de-novo site launches, in coordination with the infrastructure team.
• Advise application, data, and clinical systems teams on secure design practices (secure SDLC, API security, EHR/clinical system integrations).
• Perform other duties as assigned
• Adheres to Code of Conduct and Mission & Value Statement.
• Participates in special projects as needed.