Program Manager, Cyber Risk

About the role

The Cyber Risk Program Manager plays a key role in supporting Valley Health’s information security efforts. This position helps identify and assess potential security risks, working closely with teams to ensure alignment with security policies and the Risk Management Framework (RMF). The role monitors the security posture of systems, leads the vulnerability management program, oversees IT audit processes, and serves as backup to the Manager of Information Security.

Responsibilities

• Monitor the security posture of systems, offering risk‑based recommendations and assisting with reviews and authorizations to operate.
• Lead the vulnerability management program, applying knowledge of applications, operating systems, networks, cloud infrastructure, and cyber‑threat tactics.
• Collaborate with internal teams to remediate vulnerabilities and implement strategies that protect company assets and data.
• Oversee IT audit processes, providing documentation to prove compliance with HIPAA Security Regulations, NIST guidelines, and other governmental regulations.
• Ensure adherence to organizational security policies and procedures.
• Make recommendations on security policies to keep them current and effective against emerging threats and regulatory requirements.
• Serve as backup to the Manager of Information Security, handling escalations and participating in decision‑making when higher‑level guidance is required.

Qualifications

• Bachelor’s or postgraduate degree in Business, Computer Science, Information Security, or a related field.
• 7+ years of experience in information technology.
• 5+ years of experience in cybersecurity, risk management and/or IT audit, and/or regulatory compliance and information security management frameworks (e.g., HIPAA Security Regulations, HITECH Act, ISO 27000, COBIT, NIST 800 RMF).
• Industry‑advanced level cybersecurity certification required within 1 year of hire.
• Working knowledge of hospitals and the healthcare industry.
• Ability to communicate complex technical concepts to both technical and non‑technical audiences and collaborate effectively with IT teams and stakeholders.
• Understanding of risk assessment methodologies, vulnerability‑management lifecycle, and relevant healthcare regulations and data‑privacy laws.
• Strong grasp of cyber‑risk management frameworks (NIST, ISO 27001, etc.) and experience with GRC tools, process automation, security metrics, and policy management.
• Commitment to staying current with the latest cybersecurity trends, threats, and technologies, including participation in ongoing training and certification programs.
• A strong technical foundation in information security combined with an understanding of business and governance processes.

Benefits

• Zero‑deductible health plan
• Dental and vision insurance
• Generous paid time off
• Tuition assistance
• Retirement savings match
• Robust employee assistance program for emotional wellbeing
• Membership to Healthy U, an incentive‑based wellness program
• Health savings account and flexible spending account for childcare
• Life insurance, short‑term and long‑term disability coverage
• Professional development opportunities
• Discounts to on‑campus dining and other regional employer perks

Pay

Pay range: $47.28 – $73.94 per hour.

Schedule

First Shift (United States of America). On‑site work required 2–3 days a week at the Winchester Medical Center campus.