[Hiring] IT Security Program Manager @Recovery Centers of America

Role Description

The IT Security Program Manager is responsible for executing and managing the day-to-day operations of Recovery Centers of America's cybersecurity program. This role will coordinate and perform audits, oversee third-party risk management, manage RCA's security awareness and phishing programs, drive policy governance, and ensure the timely resolution of open risk items and vulnerabilities.

• Manage the daily operations of RCA's cybersecurity program under the guidance of the CISO.
• Coordinate and track the completion of internal and external security audits, including HIPAA, SOC 2, and NIST-based assessments.
• Maintain and monitor the Information Security Risk Register, ensuring timely resolution of identified issues and mitigation of critical findings.
• Lead tabletop exercises and incident response simulations to test and improve RCA's preparedness and business continuity planning.
• Collaborate with RCA leadership and department heads to ensure that security policies and controls are understood and effectively implemented across all business units.
• Manage the third-party risk assessment program, ensuring that all vendors with access to PHI or critical systems undergo security evaluation and periodic reassessment.
• Review BAAs, security questionnaires, and compliance attestations; ensure corrective action for identified gaps.
• Partner with Procurement and Legal to integrate security requirements into new and existing vendor contracts.
• Work with the CISO to review, update, and publish information security policies, standards, and procedures in accordance with HIPAA, HITECH, and NIST frameworks.
• Develop dashboards and recurring reports to track security metrics, compliance posture, and program maturity for presentation to the CISO and executive leadership.
• Monitor and interpret changes to regulatory requirements, ensuring timely updates to RCA's compliance program.
• Administer and optimize RCA's KnowBe4 Security Awareness and Phishing Training Program.
• Track user engagement and training completion rates, and provide metrics and recommendations to leadership.
• Develop creative awareness campaigns to strengthen RCA's security culture.
• Identify and track critical infrastructure vulnerabilities, working with IT and Infrastructure teams to ensure remediation and continuous monitoring.
• Oversee MDM security, ensuring appropriate device controls, encryption, and enforcement of mobile security policies.
• Support the CISO in analyzing threat intelligence, vulnerability trends, and endpoint security performance (e.g., CrowdStrike, firewall alerts).
• Ensure continuous compliance with HIPAA, HITECH, and NIST 800-53 / 800-171 requirements.
• Coordinate with Compliance, Legal, and Clinical leadership to ensure consistent risk management practices.
• Participate in post-incident reviews, documenting lessons learned and recommending process improvements.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Information Technology, or related field required.
• Minimum of 5-7 years of progressive experience in cybersecurity, IT risk management, or audit within a regulated environment (preferably healthcare).
• At least 2 years in a program management or leadership role overseeing information security functions.
• Strong working knowledge of HIPAA, NIST 800-53, HITRUST, and security risk management frameworks.

Requirements

• Security +, CISSP, CISM, CRISC, HCISPP, or equivalent security certification (preferred but not required).
• PMP or similar project management certification is a plus.
• Understanding of endpoint protection, SIEM tools, MDM platforms (e.g., Intune), and vulnerability management solutions.
• Experience with vendor risk tools, audit tracking systems, and compliance reporting.
• Familiarity with Microsoft 365 Security Suite, KnowBe4, and GRC platforms.

Benefits

• Limited travel is required for this position.
• This position is primarily a remote position.