Chief Information Security Officer

At Texas Children’s Hospital, our mission starts with our people. Guided by our HEART values-Humility, Excellence, Accountability, Respect, and Trust-we strive to create a workplace where teammates feel valued, supported, and empowered to do their best work every day.

The Chief Information Security Officer is a strategic leader responsible for designing, implementing, and advancing a comprehensive cybersecurity program that safeguards sensitive health information and critical systems across the Texas Children’s enterprise. This role partners closely with executive leadership to align security initiatives with organizational priorities-ensuring regulatory compliance, strengthening risk management, and fostering a culture of security awareness in support of delivering exceptional care.

What You’ll Do:

Lead Enterprise Security Strategy

• Define and execute a forward-looking information security strategy aligned with organizational and clinical priorities
• Establish scalable, enterprise-wide security frameworks, policies, and standards
• Partner with executive leadership to integrate cybersecurity into broader business and technology strategies

Protect Critical Systems & Data

• Safeguard the confidentiality, integrity, and availability of ePHI and other sensitive data across the organization
• Identify, assess, and mitigate cybersecurity risks in a complex healthcare environment
• Strengthen defenses against evolving threats through proactive monitoring and continuous improvement

Drive Compliance & Governance

• Ensure compliance with HIPAA, HITECH, and applicable federal and state regulations
• Align security practices with industry standards such as NIST and ISO frameworks
• Lead audit readiness efforts and support regulatory and accreditation requirements, including Joint Commission standards

Lead Incident Response & Risk Management

• Oversee incident response capabilities, including detection, investigation, containment, and recovery
• Develop and maintain robust risk management and remediation strategies
• Provide clear, timely communication and reporting during security events

Advance Security Through Technology & Innovation

• Partner with IT to embed security across infrastructure, applications, and digital health technologies
• Oversee security practices related to cloud environments, identity and access management, and data protection
• Ensure secure integration of EHR systems and medical devices

Build a Culture of Security Awareness

• Champion security awareness and training programs for teammates and clinical staff
• Promote a culture of accountability and shared responsibility for protecting patient and organizational data

Lead & Develop High-Performing Teams

• Build, mentor, and lead a high-performing information security team
• Establish clear goals, performance expectations, and professional development pathways
• Foster collaboration across teams to drive security maturity and operational excellence

Provide Strategic Insight to Leadership

• Deliver regular security updates, risk assessments, and actionable insights to executive leadership and the board
• Translate complex technical risks into clear business impact and strategic recommendations

Strengthen Enterprise Partnerships

• Collaborate with IT, Compliance, Legal, Risk, and operational leaders to embed security across all functions
• Manage third-party/vendor risk and ensure strong external security practices

Expertise & Leadership Capabilities

• Deep knowledge of healthcare regulations (HIPAA, HITECH) and security frameworks (NIST, ISO/IEC 27001)
• Experience in risk assessment, incident response, and security operations in complex environments
• Strong understanding of EHR systems, medical device security, and healthcare technologies
• Expertise in cloud security, identity & access management, and data protection strategies
• Experience managing third-party/vendor security risk

What You'll Bring:

Qualifications:

• 10+ years of progressive experience in information security (Required)
• 5+ years of leadership or management experience (Required)
• 3+ years of experience in a healthcare environment (Preferred)

Education

• Bachelor’s degree in information security, Computer Science, Information Technology, or related field (required)
• Master’s degree (preferred)

Preferred Certifications

• CISSP - Certified Information Systems Security Professional
• CISM - Certified Information Security Manager
• HCISPP - Healthcare Information Security and Privacy Practitioner