|
The Director of Information Security leads and maintains the New York Genome Center's (NYGC) information security program, including security governance, risk management, security operations, and incident response. The role protects clinical, research, and business information across enterprise systems, cloud services, and research environments. The Director establishes security policies, coordinates risk management and compliance activities, and leads incident response. Working with executive leadership, IT, researchers, and external security providers, the Director investigates suspicious activity, maintains assigned security tools, coordinates remediation, and ensures security findings are documented and addressed. The position uses operational evidence and risk assessments to inform compliance activities, program improvements, and security priorities. This position reports to the Senior Vice President of Informatics and serves as NYGC's Information Security Officer. The Director is accountable for the overall security program, partnering with executive leadership, IT, researchers, legal, privacy, and operational stakeholders. The role establishes security priorities, recommends resource allocations, and communicates material risks and mitigation options to authorized organizational decision-makers. Key Responsibilities Security Program Leadership and Governance
Establish and maintain the enterprise security strategy, governance structure, multiyear roadmap and annual implementation plan aligned with NYGC's mission, operational needs, and risk priorities.
Author, maintain, and coordinate approval of security policies, standards, and procedures. Establish processes for policy reviews, implementation, exceptions, and documented approvals.
Translate organizational priorities and risk assessments into security objectives, investment proposals, and measurable outcomes.
Lead security budget development proposals, resource plans, technology selection, and service-provider strategy.
Present security performance, material risks, resource needs, and strategic recommendations to executive leadership.
Enterprise Risk Management and Compliance
Establish the security risk assessment methodology, risk register, reporting structure, escalation criteria and remediation tracking.
Lead a security program aligned with the NIST Cybersecurity Framework, including current-state assessments, target-state planning, and prioritized improvement initiatives.
Integrate security risk reporting with organizational governance, budgeting, and planning.
Lead security activities supporting applicable HIPAA Security Rule compliance, in partnership with privacy, legal, compliance, and operational stakeholders.
Hold security audits, control assessments, evidence management, and corrective action programs.
Establish and manage third-party security risk management requirements and oversee significant vendor and contractual security reviews.
Evaluate security obligations associated with research funding, contracts, collaborations, and data-use agreements in partnership with responsible stakeholders.
Coordinate responses to external security questionnaires and requests for security assurance.
Present unresolved risks and treatment options to leadership and obtain documented decisions from authorized risk owners.
Security Operations and Technical Risk Oversight
Establish the security operating model, service expectations, escalation procedures, and performance measures.
Direct security monitoring, incident detection, vulnerability management, penetration testing, and remediation oversight.
Oversee external monitoring and response providers.
Establish security requirements for identity, privileged access, endpoints, networks, cloud services, logging, and sensitive data protection.
Evaluate significant technology and security architecture decisions and prioritize technical risk reduction initiatives.
Conduct security-tool selection, deployment, integration, maintenance, and effectiveness.
Establish accountability and escalation processes for persistent control gaps and overdue remediation.
Assess the effectiveness of security investments and direct improvements in operational coverage and capability.
Partner with IT and system owners to implement safeguards, address control gaps, and resolve overdue remediation.
Incident Leadership and Organizational Resilience
Own and maintain the incident response program, including plans, exercises, escalation criteria, and continuous improvement.
Lead coordination of security investigations, containment, recovery, and post-incident corrective actions.
Advise executives on incident impact, containment priorities, recovery risks, and resource requirements.
Coordinate with IT, legal, privacy, communications, operational leaders, and external responders as appropriate.
Partner with organizational leaders and system and business owners to establish security requirements for continuity, backup, and recovery capabilities.
Ensure incident findings and exercise results inform policy, operational improvements, and investment decisions.
Provide leadership during significant incidents outside normal business hours under established coverage arrangements.
Research Security Data Protection and Organizational Engagement
Integrate security requirements into major clinical, research, and technology initiatives.
Partner with scientific and operational leaders to protect sensitive data while supporting research and collaboration.
Establish consistent security review processes for research environments, external data sharing, and new partnerships.
Resolve cross-functional security priorities and communicate practical recommendations to organizational leaders.
Direct the security awareness program and establish targeted education for employees, researchers, and leadership.
Partner with researchers, clinical teams, and IT to protect sensitive information throughout its collection, use, storage, transfer, and disposal.
Establish security requirements for research computing, cloud environments, external collaborations, and data-sharing workflows.
Evaluate proposed research and clinical workflows and recommend practical safeguards.
Develop and oversee security awareness training, phishing education, and targeted guidance for specialized teams.
Communicate security requirements clearly and support their implementation across departments.
Required Qualifications
Bachelor's degree in information security, computer science, or a related field, or equivalent relevant experience.
At least 10 years of progressively responsible information security experience, including at least 2 years leading security programs with responsibility for strategy, budgets, and executive reporting.
Demonstrated experience establishing or substantially improving an enterprise security program aligned with the NIST Cybersecurity Framework.
Demonstrated leadership across security risk management, incident response, vulnerability management, third-party risk, and security operations.
Experience establishing an organization-wide security policy framework and authoring policies, standards, and procedures.
Experience developing multiyear security roadmaps, managing budgets, and prioritizing investments based on risk and organizational needs.
Experience directing staff or service providers and leading cross-functional security initiatives.
Ability to advise executives and communicate technical risks, business consequences, and actionable recommendations.
CISSP, CISM, or a comparable certification demonstrating security leadership expertise.
Preferred Qualifications
Advanced degree in information security, computer science, business administration, or a related field.
Experience leading security in healthcare, genomics, academic research, or another environment handling sensitive clinical or research information.
Experience supporting federally funded research and interpreting security obligations in grants, contracts, sponsor requirements, or data-use agreements.
Experience leading implementation or assessment of controls drawn from NIST SP 800-53 or SP 800-171 where applicable.
Experience securing research computing, cloud environments, and external data-sharing arrangements.
Additional relevant credentials in risk management, auditing, cloud security, or incident response.
Competencies
Technical and Professional Skills: Demonstrates strong judgment, integrity, discipline, and reliability; appropriately prioritizes work, manages expectations, and consistently delivers on commitments..
Collaborative & Communicative: Builds strong relationships across functions; communicates clearly and thoughtfully; listens carefully; fosters collaboration and trust..
Adaptable & Innovative: Embraces change, anticipates challenges, develops practical solutions, and continuously seeks opportunities to improve organizational effectiveness.
Leader and Manager: Aligns people and priorities around institutional goals; inspires collaboration; drives execution; develops talent; and translates vision into action.
Work Location This position will require to be on site at least 2 days at our downtown Manhattan location.. Occasional evening and weekend work may be required. Salary & Benefits The pay range for this position is $210,000-220,000 per year; the base pay offered may vary depending on job-related knowledge, skills, and experience. In addition, NYGC offers a full range of medical, financial, and other benefits as well as generous time off. This includes Medical/Dental/Vision for employees & dependent(s); Vacation, Holidays, Sick, and Other Leave, including a paid winter break; a 401(k) match; Life Insurance; Flexible Spending Accounts; employee Tuition Reimbursement; an Employee Assistance Program; and much more. About the New York Genome Center The New York Genome Center (NYGC) is an independent, nonprofit, academic research organization dedicated to advancing genomic research. NYGC scientists and staff are furthering new approaches to diagnosing and treating neurological diseases and cancer through their unique capabilities in whole genome sequencing, RNA sequencing, state-of-the art analytics, and the development of genomic tools. NYGC concentrates specifically on disease-based research in the following areas: neuropsychiatric disease (autism, schizophrenia, bipolar); neurodegenerative disease (ALS, Alzheimer's, Parkinson's, Huntington's), and cancer. Located in Lower Manhattan, the New York Genome Center was founded by and remains closely affiliated with the leading academic medical centers and research universities in the New York region, engaging in research projects with and for these institutions. Essential to our collaborative work is an outstanding faculty, whose members typically hold a joint appointment at NYGC and a partner university. They support our scientific mission by conducting independent research in areas of mutual interest to us and the wider scientific community. Equal Opportunity We are committed to fostering a workplace environment that is welcoming and fair to all, ensuring that every employee has the opportunity to thrive. We believe that bringing together individuals with diverse backgrounds, experiences, and perspectives leads to greater collaboration, innovation, and discovery. Valuing and supporting each employee in reaching their full potential strengthens our organization and enhances our collective success. We recognize that creating an environment where all employees feel valued and included requires sustained effort and dedication from the entire organization. The New York Genome Center is a VEVRAA Federal Contractor. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, creed, color, gender, religion, national origin, sexual orientation, age, disability, genetic predisposition or carrier status, protected veteran or military status, domestic violence victim status, partnership status, caregiver status, alienage or citizenship status, marital status, or any other characteristic protected by applicable law. NYGC takes affirmative action in support of its policy to hire and advance in employment individuals who are protected veterans and individuals with disabilities. FLSA Status - Exempt This position is eligible for relocation assistance This position is not eligible for visa sponsorship
|
New York Genome Center
$210,000.00 - $220,000.00 / yr
life insurance, tuition reimbursement, 401(k), relocation assistance
Nov 11, 2026