Director, Information Security

Salary range: The salary range for this position is CAD $65.54 - $94.22 / hour Why Fraser Health?:
**Director, Information Security**

We are seeking a strategic Director of Information Security to provide leadership and direction towards enhancing cybersecurity and sustainability within Fraser Health (FH). The director will be accountable for establishing and advising on authority wide governance and industry best practices while overseeing the evaluation and implementation of information security tools.

This is an exciting and important opportunity to lead and advance information security within healthcare by assessing security threats and risks associated with Fraser Health’s continuing operations. Additionally, the director will provide guidance and leadership to staff when responding to security compliance audits conducted by third parties and regulators such Accreditation Canada, BC Office of the Auditor General and Ministry of Health.

Detailed Overview:
**_ Supporting the Vision, Values, Purpose and Commitments of Fraser Health including service delivery that is centered around patients/clients/residents and families:_**

Provides leadership and management for Fraser Health's (FH) enterprise information security and data stewardship program, working closely with multiple partners and stakeholders. The role combines responsibilities for both information security and data stewardship, recognizing and building upon the need to both manage and protect data as a key enterprise asset.

The scope of responsibilities includes establishing strategic directions for FH; providing advisory services including training and education; establishing authority wide governance structures, policies and practices; and operating ongoing program services - working closely with internal stakeholders and partner organizations.

**Responsibilities**:
**Information Security**
- Develops and executes an enterprise wide information security program, strategy and roadmap ensuring the continued management and protection of FH data and technology assets, working with the Provincial Health Services Authority (PHSA) Technology Services and other key stakeholders.
- Establishes policies, procedures, standards, definitions and guidelines that enable the organizational information security strategy and promote compliance with legal and regulatory requirements. Supports the governance of the security strategy, to promote appropriate organizational engagement and oversight.
- Develops and maintains a program that informs executive, business unit and functional group leadership of the top security risks and overall security health of the organization. Works with executive management to determine acceptable levels of risk for the organization.
- Establishes, implements and delivers communications and training initiatives to increase information security, cybersecurity awareness as well as support and promote the adoption of safe computing practices.
- Creates a framework for roles and responsibilities with regard to information ownership, classification, accountability and protection of information assets.
- Collaborates and liaises with the data privacy officer to support the inclusion of data privacy requirements, where applicable.
- Participates in the development, implementation and ongoing compliance monitoring of information security requirements; ensures FH's continued alignment with regulatory information security requirement.
- Provides leadership and direction to staff in conducting organizational Security Threat and Risk Assessments (STRAs).
- Identifies and assesses security threats, vulnerabilities and risks associated with FH's ongoing operations; establishes and maintains detection, containment and incident response capabilities to identify and mitigate cyber-attacks; oversees the evaluation, selection and implementation of information security tools. Works in partnership with PHSA Technology Services and others to coordinate all security related issues.
- Working with the architecture function in FH, PHSA Technology Services and others, promote the understanding of information security requirements within architectures.
- Works to embed security in the project delivery process by providing the appropriate information security policies, practices and guidelines.
- Provides leadership and direction to staff in evaluating and responding to security compliance audits conducted by third parties and regulators such as Lower Mainland Internal Audit, Accreditation Canada, BC Office of the Auditor General, BC Office of the Information and Privacy Commissioner, and the Ministry of Health Services.
- Participates in the formation and execution of business continuity planning, and disaster recovery planning.

**Data Stewardship**
- Develops and executes an enterprise wide data stewardship program, strategy and roadmap.
- Supports the governance of the data stewardship strategy, to promote appropriate organisational engagement and ov