Senior Information Security Advisor

Transcription

1 Principles Vision Purpose Statement Senior Information Security Advisor healthalliance Purpose, Vision and Principles To be right behind better healthcare. Our role as provider of non-clinical services to the Northern Region DHBs includes Information Services, Staff Services (Payroll and HR Administration), Regional Internal Audit and to the National DHB Sector Finance, Procurement, and Supply Chain (FPSC). To be the recognised experts in making the health dollar go further. We will assist the health sector to spend wisely, enabling DHBs to direct money to frontline clinical services, by providing savings, automating processes, enabling efficiencies and standardisation. Partnership Developing lasting partnerships through collaboration, working to a common goal, facilitating joint solutions within our means, recognising and celebrating success, open communication to share knowledge and information. Respect for people We respect others by; developing trust by being open and honest, listening to and understanding others views, valuing everyone s contribution, celebrating diversity and have fun and enjoy what we do as a team. Integrity We show integrity by; leading by example, open, fair, honest and transparent in everything we do, courage to speak up and challenge when things don t seem right, act ethically and professionally at all times, can do, will deliver our promises, obligations and commitments. Delivering Results We deliver results by; delivering exceptional results through high performance teams, enhance the customer experience, continually improve and add value, being action orientated, responsible and accountable, providing consistent and reliable services. Energised by Innovation We are energised by innovation when we; encourage forward thinking ideas and challenge status quo, measure our performance and see it as an opportunity to learn and grow, creating positive change by developing smarter ways to work, empowering people to maximise potential. Our principles define the expected behaviour of all staff and guide us on the behaviours that are important to us as an organisation. They underpin the way we do things at healthalliance, defining how we strive to move towards our vision

2 This position description provides an indicative outline of the purpose and key responsibilities and tasks of the role. Title and Reporting Relationships Position title: Reporting to: Location: Senior Information Security Advisor Chief Information Security Officer Auckland Purpose of the Role The Senior Information Security Advisor is a key role in assisting the Chief Information Security Officer (CISO) in establishing the inceptive Information Security Programme for healthalliance (ha) and the Northern Region District Health Boards (NRDHBs). Reporting to the Chief Information Security Officer, the Senior Information Security Advisor function will provide customer advocacy and expertise in the development of security policy and initiatives in support of the Information Security Programme for healthalliance and the NRDHBs. The role informs security policy design and targeted training and campaign creation, as well as advises on and synthesise matters of cyber-business risk and privacy issues that then most accurately and thoughtfully drive information security initiatives using the integration of health informatics and security principles. Personnel Dimensions (Employees reporting to this position directly and indirectly) Number of Staff: Direct: 0 Through subordinates: 0 Total: 0 Key Relationships People and organisations both inside and outside of the company that this position would be required to manage relationships with. Internal Stakeholders healthalliance management healthalliance staff Stakeholder representatives External Stakeholders DHBs Service Providers and Key Suppliers Customer Groups Position in Organisation - 2 -

3 SISA Key Responsibilities and Tasks Develop and execute on education and awareness initiatives and campaigns to help create a culture of security for ha and the NRDHBs. Expected Outcomes Good security decisions are recognized in stakeholder behaviour which drives a culture of security Provides thought leadership and advisory on the definition and establishment of the regional information security strategy including the development and implementation of effective security administration standards, processes, policies and practices across the NR. Provide guidance on the adoption and adherence of information security policies, standards and procedures that promote corporate cyber security awareness activities. An information security strategy, endorsed by a regional governance forum, includes information security policies, standards and guidelines that are developed, maintained and published. Integrated pathways are used by ha and the NRDHBs to achieve and maintain the security vision and objectives of the NRDHBs. Work collaboratively with customers and stakeholders to negotiate and execute on information security programme initiatives. Programme initiatives are delivered in-line with agreed customer and stakeholder expectations and align with the overall information security strategy. Act as a conduit for customer and stakeholder feedback by advising the CISO on cyber security opportunities as part of the information security programme. Customers and stakeholders are engaged with the objectives of the information security programme and advocates for its business value

4 Perform continual evaluation of the security posture of customers and stakeholders and identify opportunities to improve the effectiveness and performance of the delivery of the Information Security Program. Security initiatives remain aligned between the security, enterprise architecture and business requirements and potential adjustments recommended to the CISO. Serve as a liaison to other organisations or governmental agencies or information security advisory groups. May serve on planning and leadership policy-making committees, serving as a deputy to the CISO Security initiatives realise demonstrable value to the NR as a result of effective relationship management with other groups or organisations relevant to information security. CISO initiatives and strategies are represented in-line with expectations. Manages key projects and programmes as identified by the CISO that deliver special value opportunities into the information security strategy portfolio. Security programmes and projects are managed in compliance with relevant laws, regulations and policies and successfully deliver to the larger ha and cyber security strategies and vision. Professional Development Accept responsibility for own professional development. Annually agree professional development plan with your Manager. Successfully complete formal training and share knowledge to upskill other team members. Liaise with all customers (internal and external) as required in a helpful and polite manner Health, Safety and Wellbeing Support healthalliance health, safety and wellbeing culture and to recognize individual responsibility for Workplace Health and Safety under the Health and Safety Employment in Act

5 General Development and training plans are in place Knowledge sharing among team members Spirit of co-operation with other work areas/departments is maintained Support healthalliance health, safety and wellbeing culture by: Ensuring a safe working environment and safe working practices Reading and understanding healthalliance Health and Safety policies and relevant procedures and applying to own work activities Identifying, reporting and managing hazards where appropriate Displays commitment through actively supporting all health, safety and wellbeing initiatives Consistently displays the principles of the organisation Adheres to and observes all organisational policies, methodologies and practices Other duties as required by the Manager in addition to or as a result of changing circumstances, that contributes to achieving the purpose of the role - 5 -

6 Qualification, Experience and Training Requirements What is the typical background required to competently perform the responsibilities of the job? Essential is the minimum acceptable level for entry. Preferred indicates the desirable level, but may also expand on the nature, eg: industry related, level of previous supervisory experience. Essential Broad knowledge of IT cybersecurity principles and systems Preferred Knowledge of health system regulatory and legislative requirements Outstanding oral and written communications skills. Strong relationship building capabilities across and within organisations Experience in the delivery of ICT healthcare services or health informatics Advanced globally recognized information security certification, or willingness to obtain one, such as CISSP, CISM, CASP, or degree, etc. Knowledge of international and NZ IS security standards, such as ISO/IEC 2700x, HISO, NZISM, NZ PSR and NIST 800, SAN Ability to influence and drive change Bachelors degree (Masters preferred) in IT, health systems or similar areas 10 years of direct work experience in a senior management role - 6 -

7 Competencies for the Role Decision Quality Planning Process Management Conflict Management Drive for Results Interpersonal Savvy Customer Focus Makes good decisions (without considering how much time it takes) based upon a mixture of analysis, wisdom, experience, and judgement; most of his/her solutions and suggestions turn out to be correct and accurate when judged over time; sought out by others for advice and solutions Accurately scopes out length and difficulty of tasks and projects; sets objectives and goals; breaks down work into the process steps; develops schedules and task/people assignments; anticipates and adjusts for problems and roadblocks; measures performance against goals; evaluate results. Good at figuring out the processes necessary to get things done; knows how to organise people and activities; understands how to separate and combine tasks into efficient work flow; knows what to measure and how to measure it; can see opportunities for synergy and integration where others can t; can simplify complex processes; gets more out of fewer resources. Reads situations quickly; good at focussed listening; can hammer out tough agreements and settle disputes equitably; can find common grounds and get cooperation with minimum noise. Can be counted on to exceed goals successfully; is constantly and consistently one of the top performers; very bottom-line oriented; steadfastly pushes self and others for results. Relates well to all kinds of people-up, down, and sideways, inside and outside the organization; builds appropriate rapport; build constructive and effective relationships; uses diplomacy and tact; Is dedicated to meeting the expectations and requirements of internal and external customers; get first-hand customer information and uses it for improvements in products and services; acts with customers in mind; Establishes and maintains effective relationships with customers and gain their trust and respect. Total Quality Management Seeks to reduce variances in organization processes; deliver the highest quality products and services which meet the needs and requirements of internal and external customers; is committed to continuous improvement through empowerment and management of data; leverages technology to positively impact quality; is willing to re-engineer processes from scratch; is open to suggestions and experimentation

8 Note: The position needs to be reviewed by both parties annually. Signed as current and agreed: Manager Employee - 8 -