Director Resiliency, Global Crisis Management

Position in this function within the Enterprise Security and Resilience Office (ESRO) we are the first-line defense against securing the largest healthcare company in the world against security threats.

We are focused on transformation by strengthening our cyber defenses, ransomware resiliency, mitigating vulnerabilities, and better securing all aspects of our company, globally.

We are vigilant and passionate about protecting the sensitive data of our members and providers and are committed to leveraging every tool, partnership and process needed to enhance our security posture. It is our duty to protect the information of those we serve and help fulfill our mission of making the health care system work better for everyone.

Primary Responsibilities:

This position serves as an all-hazards incident commander, with a focus on responsibility for the overall leadership of large and complex cyber incidents.

This position is expected to lead events to resolution as quickly and completely as possible, managing the resources, plans, and communications involved in that resolution. Effective management is key to limiting the disruption caused by an incident and restoring normal business operations as quickly as possible.

This position will work closely with senior leaders from response teams across the enterprise to assure effective coordination and resolution of incident response.

This position will help develop and maintain Global Crisis Management cyber response plans and processes to assure efficient and coordinated response to events and maintain a continuous improvement process to keep the program aligned with company goals and strategies, and to align with industry standards and best practices.

As an all-hazards leader, this role will lead other major non-technology incidents as needed. Position will lead and participate in exercises to test plans and processes as outline in the multi-year training and exercise plan.

• Incident Preparation: sets up communication channels, invites the appropriate people into those channels during an incident, and trains team members on best practices for not only incident management, but also communication during an incident
• Decision Making: quickly assesses an incident and makes decisions about what to do, which team members are needed, and what actions come next at every stage of the resolution process
• Delegation: delegates tasks to appropriate teams and know when to expand the team by pulling in additional developers, communication experts, etc.
• Oversight: oversees the response and resolution process from start to finish, asks the right questions, gets regular status reports from each team member, and prioritizes next steps
• Team Alignment: oversees communication and makes sure everyone is on the same page; keeps conversations focused and brief to minimize time to resolution
• Escalation and Resource Management: escalates issues to more senior or specialized resources and/or brings in additional resources to speed up resolution
• After-Action: creates documents where teams can share their thoughts, plans after-action meetings, and makes recommendations on how to prevent or reduce the impact of future incidents
• As a leader on the Global Crisis Management team, incumbent will be part of the all-hazards response team with response duties outside of cyber events.
• 24x7 on-call support

Required Qualifications:

• 5+ years of technical, hands-on experience in one or more cyber security domains - security operations, forensics, incident response, IAM, pen testing, red teaming, hunt, cyber intelligence, etc.
• 5+ years of responsibility for planning, development, and maintenance of cyber and/or all-hazard response plans
• 3+ years of experience leading significant cyber-security and/or all-hazards incidents.
• 3+ years of experience developing and facilitating exercises, and conducting after-action reviews
• 3+ years of experience interfacing with senior executives
• Proven solid communication: ability to communicate ideas clearly and concisely
• Problem-solving: Proven to identify and solve complex problems in high-pressure situations; ability to think critically and creatively to come up with practical solutions
• Decision-making: Proven to weigh the pros and cons of different options and quickly make confident decisions; ability to make decisions with limited information
• Listening and synthesis: Proven to efficiently seek out and understand different perspectives; use that information to make better decisions
• Leadership: Proven to take command in high-stress situations; inspire and motivate the team, while also providing clear guidance and direction; prioritize tasks based on their urgency

Preferred Qualifications:

• Demonstrated high-level knowledge of incident management best practices and systems
• Demonstrated understanding of risk management, mitigation, and incident response
• Demonstrated experience communicating with senior management and executives.