Manager of Cybersecurity Legal Governance, Risk, and Compliance ("GRC")

Under the direction of the Deputy Chief Information Security Officer, the Manager of Cybersecurity Legal Governance, Risk, and Compliance ("GRC") is instrumental in the identification and mitigation of information security risks at Tampa General Hospital (TGH) and partner organizations, responsible for collaborating with stakeholders across the organization and performing tasks critical to the Cybersecurity GRC Program. This position requires excellent communication skills, with the ability to engage effectively with a wide range of stakeholders, and a keen attention to detail with the ability to review complex legal and technical documentation. This role is crucial to the organization's cybersecurity posture and risk management efforts. Performs Job duties as assigned in accordance with mission, vision and values of Tampa General Hospital.

Essential Functions\:

• Supervise and manage five key GRC elements\: vendor risk management, compliance/audits, governance & training, data protection, and enterprise risk management.
• Supervise and manage the cybersecurity risk associated with third-party vendors and service providers. Ensure that the organization’s cybersecurity requirements are updated as appropriate and communicated internally and externally to third-party vendors and service providers.
• Supervise comprehensive cybersecurity assessments using industry-standard frameworks, eg NIST CSF.
• Supervise maintenance of HITRUST certification.
• Supervise the organization’s HIPAA and HITECH compliance program. Support team through annual assessments, communication of findings, and development of controls and/or security architecture to ensure ongoing compliance.
• Supervise the organization’s Payment Card Industry Data Security Standard (PCI DSS) compliance program.
• Supervise creation and maintenance of risk register that identifies and prioritizes cybersecurity risk scenarios. Educate business leaders re quantitative risk assessment methodologies to provide insights into potential financial and operational impacts of cyber risks.
• Manage the development, implementation, and evolution of cybersecurity policies and procedures. Ensure alignment with industry regulations and frameworks, and support the organization’s security governance strategy.
• Supervise internal and external audits related to cybersecurity governance, risk, and compliance. Communicate with business leaders as needed to educate and support such audits.
• Manage efforts to continuously improve the organization’s cybersecurity governance, risk management, and compliance processes. Monitor industry trends, emerging threats, and regulatory changes to ensure that the organization’s GRC strategy remains effective and up-to-date.
• Create reports and communicate technical assessment findings and remediation strategies with senior leadership, auditors, and regulators regarding cybersecurity governance, risk, and compliance issues. Review team reports and updates on compliance status, risk levels, and remediation progress.
• Manage development and implementation of a robust cybersecurity awareness training program, providing engaging in-person and virtual training tailored for clinical and administration team members.
• Drive compliance efforts aimed at reducing and mitigating cyber risks.
• Provide strategic guidance on new products and services as relating to cybersecurity legal risks.
• Leverage business relationships to guide decision makers toward solutions that balance business needs while mitigating risk.
• Streamline and update processes and procedures to increase efficiency and compliance.
• Supervise e-discovery process and procedures.
• Manage and support team in alignment with TGH Core Values.
• Maintain awareness of new cybersecurity threats, regulations, guidance, best practices, etc.
• Identify and advocate for tools and resources the team needs to excel in their work.
• Support team members' career development and goals.
• Manage enterprise risk management program.
• Supervise data protection program.
• Maintain budget for GRC team.
• Pursue Collaborative High Reliability Training.
• Develop and implement contract standards and processes that align with industry best practices and cybersecurity frameworks to enhance cybersecurity risk mitigation and regulatory compliance.