Surescripts serves the nation through simpler, trusted health intelligence sharing, in order to increase patient safety, lower costs and ensure quality care. We deliver insights at critical points of care for better decisions - from streamlining prior authorizations to delivering comprehensive medication histories to facilitating messages between providers. Job Summary: The Director, Threat Management helps carry out the strategy of a proactive information security program by leading through effective identification and mitigation of the cyber threats that are posed to the Surescripts network. The Director, Threat Management oversees the implementation and management of cutting-edge tools and methodologies to detect, analyze and respond to emerging threats in real-time. The Director, Threat Management leads the Blue Team (incident response) and the Red Team (internal penetration testing) along with the Manager, Threat management to identify vulnerabilities and suspicious activities before they escalate to critical incidents. This leader directs the Incident Response team in collaboration with the Crisis Management Team. The Director, Threat Management provides critical insights into global threats, trends, cybercrime tactics and potential attack vectors specific to the healthcare industry. The role requires technical competence and business acumen to foster and maintain strong relationships with business units. The Director, Threat Management requires constant up-to-date familiarity withThreat Managementtactics, techniques, and procedures (TTPs) across all lines of business in complex environments. The Director, Threat Management also contributesto the companyinformationsecurity strategy andrisk managementroadmap. Responsibilities: Oversee and proactively coordinate the organization's cybersecurity efforts under the direction of the CISO Identify, respond to and mitigate cyber threats before they become critical incidents. Contain, mitigate and remediate incidents to ensure that the response times are minimized. Combine strategic vision with operational oversight to ensure the organization is adequately protected against a wide range of cyber threats. Manage overall cyber security risks as they pertain to Surescripts and its customers. Oversee the Threat Management operations: Threat detection Vulnerability Management Insider Threat Detection Data Loss Prevention Lead the Incident Response Teams: Perform regular tabletop exercises Ensure the right tools are leveraged for incident response Ensure ongoing staff development Collaborate with Legal and outside counsel as needed Collaborate with outside incident response teams as needed Develop and maintain up-to-date Incident Response Plans Post incident reviews and root cause analysis in a centralized location for collaboration with key stakeholders Collaborate with cross-functional partners and external partners Evaluate and implement security technologies. Ensure regulatory compliance. Prepare for audits and reporting of the Threat Management Program Establish, monitor and report Threat Management program metrics and reporting. Develop staff skills and competencies. Identify training needs and opportunities Engage when needed for merger and acquisition activities to ensure risks are mitigated effectively. Lead a team of internal and external penetration testers to ensure proper application, internal and external penetration testing isscheduled to meet the needs of the business, information security compliance and contractual requirements. Ensureservice provider contractscontainlanguage acceptable to monitoring andenforcement acrossprovidedservices andaccessibledata. Focus on active threat monitoring while adhering to, and not overstepping, privacy requirements. Baseline accounts and systems to identify deviation from expected behavior and investigate as required. Plan and execute regular tabletopdrills ofThreat Managementincident response and postmortemexercises with a focus on measurable improvement and benchmarking to show progress (or deficiencies requiring additional attention). Develop metrics and scorecards to measure risk to the organization, as well as effectiveness and efficiency of threat analysts.Manage career development forateam of analysts, including training and mentoring, conducting performance reviews andmodeling behavior forteam members. Qualifications Basic Requirements: Bachelor's degree incomputerscience,informationassurance, MIS or related field, or equivalent. 8-10+ years of information security administration, monitoring and response or related experience. Experience managingaThreat Managementprogramandleading technical teams. Demonstrated business acumen. Excellence in communicating business risk from cybersecurity topics. Strong understanding and demonstrated use of best practices following NITTF, NIST and CERT guidance. Proficientindriving measurable improvement in detection and response capabilities at scale. Experience managing SIEM, UEBA, vulnerability management,data loss prevention (DLP), threat intelligence, MITRE ATT&CKframework mapping, security orchestration automation and response(SOAR), andother network and system monitoring tools. Experience supporting investigations using formal chain-of-custody methods, forensic tools and best practices. Proficient in security analytics and threat data management. Track record of acting with integrity, taking pride in work, seeking to excel, being curious and adaptable, and communicating well. Preferred Qualifications: CISSP (preferred);CERT ITPM and/or ITVA (preferred or willing to obtain);SANS certification a plus. Keywords: threat management, blue team, red team, incident management, vulnerability management #LI-REMOTE Surescripts embraces flexibility through its Flexible Hybrid Work model for most positions. This model allows employees to work virtually while still utilizing our offices as collaboration centers. With alignment and agreement from your leadership, you can come and go from the office as needed. What You're Like You're technical. Analytical. Imaginative. Maybe you're building your own crypto-mining rig-or not. Either way, your mind works to anticipate vulnerabilities and protect the company and its information against those vulnerabilities. You do the right thing because it's the right thing without seeking to point fingers or brag. And of course, you're always willing to keep learning. What We're Like We're a team of friendly folks who do serious work. Our best work is done by rising to the occasion under stress, but we keep each other cool under pressure. We're a tight team but we also look for ways to partner across the business. Our style is casual and laid back, but we shoulder our responsibility to protect patient data from sophisticated adversaries, which sometimes means delivering a difficult truth. What the Work is Like Our challenge is to protect our customers' data and our company. This requires anomaly analysis, risk reviews, pen testing of our controls, red-teaming and tabletops, policy and procedure work, documentation, and audits. We also engineer and maintain our security products and tools. It's not always a typical 9-to-5 gig, of course, but then again, you work in information security, so you already know that. Why Wait? Apply Now We're a midsize company. This means you're not just another employee ID number. Here, you can build real relationships and feel supported by truly awesome people with diverse backgrounds and talents in an innovative and collaborative work culture. We strive to create an environment where you canbe yourself, share your ideas and work your way. We offer... For full info follow application link. Equal Employment Opportunity/Affirmative Action Employer - Disabled/Vets