Director Cybersecurity Risk Management

Description

Penn Medicine is dedicated to our tripartite mission of providing the highest level of care to patients, conducting innovative research, and educating future leaders in the field of medicine. Working for this leading academic medical center means collaboration with top clinical, technical and business professionals across all disciplines.

Today at Penn Medicine, someone will make a breakthrough. Someone will heal a heart, deliver hopeful news, and give comfort and reassurance. Our employees shape our future each day. Are you living your life's work?

Entity: Corporate Services

Department: Cybersecurity-GRC

Location: 3535 Market Street, hybrid

Summary:

The Director of Cybersecurity Risk Management is responsible for defining and leading Penn Medicine's enterprise risk management program, ensuring cybersecurity risks are identified, quantified, prioritized, and governed in alignment with organizational objectives. This role serves as a strategic advisor to senior leadership, providing actionable risk intelligence, overseeing cyber risk governance processes, and driving enterprise-wide risk treatment decisions. The Director leads the integration of cyber threat intelligence, risk quantification, risk aggregation, emerging risk management, and executive reporting into a unified risk program. The position partners with executive leadership, technology teams, compliance, privacy, legal and business stakeholders translate complex cyber risks into business decisions, enabling informed investments, risk acceptance decisions, and measurable reductions in organizational exposure.

Responsibilities:

• Risk Aggregation and Quantification:
• Maintain and evolve the enterprise cyber risk model that aggregates risks across domains (e.g., IAM, TPRM, Vulnerability Mgmt, SecOps) and quantifies exposure using defensible methods (e.g., FAIR/SAFE) to support prioritization and investment decisions.
• Maintain risk taxonomy, impact/likelihood scales, and normalization rules to ensure consistent roll ups at application, business unit, domain, and enterprise levels.
• Partner with Finance and Business stakeholders to translate cyber scenarios into loss ranges and forecasted exposure; produce quarterly quantified risk posture and top risk heatmaps
• Cyber Threat Intelligence (CTI) Triage:
• Operate a threat intake and triage workflow that maps intel to cyber risks
• Maintain an intel-to-risk pipeline: convert priority threats into scenario analyses, KRIs, and mitigation initiatives with accountable owners and time-bound outcomes.
• Coordinate with Incident Response and Vulnerability Management to ensure timely validation, enrichment, and closure of threat-driven findings.
• Human Risk Oversight:
• Lead Human Risk governance forums and steering committee activities to drive accountability, decision-making, and cross functional alignment. Present human risk posture, trends, emerging threats, and risk reduction strategies to executive leadership and governance committees.
• Oversee governance processes for human risk exceptions, risk acceptance decisions, corrective actions, and remediation initiatives.
• Ensure clear ownership, accountability, and measurable outcomes for human risk treatment activities across the enterprise.
• Establish and monitor human risk KPIs. KRIs, and escalation thresholds to support data-driven risk management and executive reporting.
• Drive targeted risk reduction efforts by identifying high-risk populations, roles and behaviors, and partnering with stakeholders to implement corrective actions.
• Steering Committee Coordination:
• Run the Cyber Risk & Steering Committee for cadence: agenda, decision memos, and action tracking.
• Present the quantified risk posture, trend lines, and treatment plans; drive decisions on priorities, funding, risk acceptance, and policy exceptions.
• Maintain a transparent decision log and ensure alignment with enterprise risk management and audit/compliance obligations.
• KRI Thresholds & Playbooks:
• Define a risk metrics framework: KRIs/KPIs tied to key scenarios (e.g., ransomware, unauthorized access, critical thirdparty risk.
• Set thresholds and red/amber/green bands with clear playbooks (trigger conditions, owners, actions, timelines, and communications).
• Automate metric collection and visualization; monitor drift, investigate signal quality, and continuously refine thresholds to reduce noise and increase leading indicators.
• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures
• Other duties as assigned to support the unit, department, entity, and health system organization
  
  

Credentials:

• Information Security Professional Certification – CISSP, CGRC, CISM, CISA, etc. is preferred.
  
  

Education or Equivalent Experience:

• Bachelor's degree is required.
• 10 years of IT and cybersecurity experience, with a minimum of 3 years within Sr. Leadership experience is required.
• 3 years of Cybersecurity Governance, Risk, and Compliance is required.
  
  

We believe that the best care for our patients starts with the best care for our employees. Our employee benefits programs help our employees get healthy and stay healthy. We offer a comprehensive compensation and benefits program that includes one of the finest prepaid tuition assistance programs in the region. Penn Medicine employees are actively engaged and committed to our mission. Together we will continue to make medical advances that help people live longer, healthier lives.

Live Your Life's Work

We are an Equal Opportunity employer. Candidates are considered for employment without regard to race, ethnicity, color, sex, sexual orientation, gender identity, religion, national origin, ancestry, age, disability, marital status, familial status, genetic information, domestic or sexual violence victim status, citizenship status, military status, status as a protected veteran or any other status protected by applicable law.