Director Cybersecurity Risk Management

Entity: Corporate Services | Department: Cybersecurity-GRC | Location: 3535 Market Street, hybrid

About the role

The Director of Cybersecurity Risk Management is responsible for defining and leading Penn Medicine's enterprise risk management program, ensuring cybersecurity risks are identified, quantified, prioritized, and governed in alignment with organizational objectives. This role serves as a strategic advisor to senior leadership, providing actionable risk intelligence, overseeing cyber risk governance processes, and driving enterprise-wide risk treatment decisions. The Director leads the integration of cyber threat intelligence, risk quantification, risk aggregation, emerging risk management, and executive reporting into a unified risk program. The position partners with executive leadership, technology teams, compliance, privacy, legal and business stakeholders to translate complex cyber risks into business decisions, enabling informed investments, risk acceptance decisions, and measurable reductions in organizational exposure.

Responsibilities

• Risk Aggregation and Quantification: Maintain and evolve the enterprise cyber risk model that aggregates risks across domains (e.g., IAM, TPRM, Vulnerability Mgmt, SecOps) and quantifies exposure using defensible methods (e.g., FAIR/SAFE) to support prioritization and investment decisions. Maintain risk taxonomy, impact/likelihood scales, and normalization rules to ensure consistent roll ups at application, business unit, domain, and enterprise levels. Partner with Finance and Business stakeholders to translate cyber scenarios into loss ranges and forecasted exposure; produce quarterly quantified risk posture and top risk heatmaps.
• Cyber Threat Intelligence (CTI) Triage: Operate a threat intake and triage workflow that maps intel to cyber risks. Maintain an intel-to-risk pipeline: convert priority threats into scenario analyses, KRIs, and mitigation initiatives with accountable owners and time-bound outcomes. Coordinate with Incident Response and Vulnerability Management to ensure timely validation, enrichment, and closure of threat-driven findings.
• Human Risk Oversight: Lead Human Risk governance forums and steering committee activities to drive accountability, decision-making, and cross functional alignment. Present human risk posture, trends, emerging threats, and risk reduction strategies to executive leadership and governance committees. Oversee governance processes for human risk exceptions, risk acceptance decisions, corrective actions, and remediation initiatives. Ensure clear ownership, accountability, and measurable outcomes for human risk treatment activities across the enterprise. Establish and monitor human risk KPIs, KRIs, and escalation thresholds to support data-driven risk management and executive reporting. Drive targeted risk reduction efforts by identifying high-risk populations, roles and behaviors, and partnering with stakeholders to implement corrective actions.
• Steering Committee Coordination: Run the Cyber Risk & Steering Committee for cadence: agenda, decision memos, and action tracking. Present the quantified risk posture, trend lines, and treatment plans; drive decisions on priorities, funding, risk acceptance, and policy exceptions. Maintain a transparent decision log and ensure alignment with enterprise risk management and audit/compliance obligations.
• KRI Thresholds & Playbooks: Define a risk metrics framework: KRIs/KPIs tied to key scenarios (e.g., ransomware, unauthorized access, critical third-party risk). Set thresholds and red/amber/green bands with clear playbooks (trigger conditions, owners, actions, timelines, and communications). Automate metric collection and visualization; monitor drift, investigate signal quality, and continuously refine thresholds to reduce noise and increase leading indicators.
• Perform duties in accordance with Penn Medicine and entity values, policies, and procedures.
• Other duties as assigned to support the unit, department, entity, and health system organization.

Requirements

• Credentials: Information Security Professional Certification – CISSP, CGRC, CISM, CISA, etc. is preferred.
• Education: Bachelor's degree is required.
• Experience: 10+ years of IT and cybersecurity experience, with a minimum of 3 years within Sr. Leadership experience is required. 3+ years of Cybersecurity Governance, Risk, and Compliance is required.

Benefits

We believe that the best care for our patients starts with the best care for our employees. Our employee benefits programs help our employees get healthy and stay healthy. We offer a comprehensive compensation and benefits program that includes one of the finest prepaid tuition assistance programs in the region.