Senior Director, Cybersecurity Strategy & Governance

The person in this role may work remotely within the US or onsite at a US-based Medtronic facility.

 

CAREERS THAT CHANGE LIVES

In this critical role you will act as Sr. Director, Cybersecurity Strategy & Governance, reporting to the VP Chief Information Security Officer (CISO), leading a team of IT/Cybersecurity professionals, ensuring the highest security standards across the Enterprise. This role is a part of the Global Cyber & Information Security Office leadership team which is responsible for assisting the CISO to establish and implement the information security governance structure and strategies, priorities, and directives consistent with the vision and in alignment with the mission of the Medtronic. We look for leaders who have a clear vision of where we are going and how to get there, bold inclusive thinkers who create new ideas and bring our best solutions forward to benefit our patients, business partners, and customers. 

 

We believe that when people from different cultures, genders, and points of view come together, innovation is the result —and everyone wins. Medtronic walks the walk, creating an inclusive culture where you can thrive.  Our unwavering commitment to inclusion, diversity, and equity (ID&E) means zero barriers to opportunity within Medtronic and a culture where all employees belong, are respected, and feel valued for who they are and the life experiences they contribute.  We know equity starts beyond our workplace, and we must play a role in addressing systemic inequities in our communications if we hope to have long-term sustainable impact.

 

Anchored in our Mission, we continue to drive ID&E forward both to enhance the well-being of Medtronic employees and to accelerate innovation that brings our lifesaving technologies to more people in more places around the world.

 

Bring your talents to an industry leader in medical technology and healthcare solutions – we’re a market leader and growing every day. You can be proud to be a part of technologies that are rooted in our long history of mission-driven innovation. You will be empowered to shape your own career.  We encourage and support your growth with the training, mentorship, and guidance you need to own your future success. Together, we can transform healthcare.  Join us for a career in IT that changes lives.  Medtronic is committed to fostering a diverse and inclusive culture.  Check out the accomplishments of our Women in IT group!  http://bit.ly/MedtronicWomeninIT

A DAY IN THE LIFE

Responsibilities may include the following and other duties may be assigned. 

General:

• Provide recommendations to the CISO on information security standards and best practices for IT projects.
• Assist the CISO to oversee and manage the effectiveness of the state’s security program, with a focus on strategy, risk, and governance.
• Provide advice to operating units at all levels on information security issues, recommended practices, and vulnerabilities remediation. Develop and deploy the security program for assigned areas to ensure policies, procedures, and objectives are closely aligned with those of the state.
• Assist in the development of metrics to measure the efficiency and effectiveness of the security program.
• Assist the CISO in strategy development and managing the information security program, focusing on security risk assessments; risk management (including risk prioritization and mitigation); education and awareness.
• Interface with law enforcement agencies and other government agencies to address security lapses and responds to information security issues.
• Respond appropriately with resources and information to requests submitted by internal and external auditing functions.
• Assign responsibilities to staff and empower employees to execute the security program.

 

Leadership:

• Enable partnerships with key internal business partners and individuals at all levels such as Legal, Facilities, Audit, HR, Corporate Communications, and other Business Unit stakeholders.  Maintain ongoing Business and Global IT relationship management.
• Ensure that strict standards of confidentiality and high integrity are maintained across the teams, based on the sensitivity of the work being performed. 
• Manage activities of a team with responsibility for results in terms of costs, methods and employees.  Accomplishes results through subordinate managers, supervisors or exempt specialist employees. Recommends organizational structures of functions and units.
• Provide leadership, domain thought leadership, management, and development of the department employees including performance management, individual development planning, succession planning, employee communications, and positive working environment to ensure high productivity, employee engagement, and performance.
• Represent the organizational unit as a prime internal and external contact on security related contracts or operations.
• Work continuously to maintain a very high-level of awareness of new trends, threats, and the constantly changing cyber landscape.  Respond quickly and appropriately to these changes with modifications to strategies and approaches in order to protect the company.
• Interacts with senior leadership and equivalent concerning matters of significance to Medtronic; and drive beneficial outcomes which preserve the cybersecurity posture of Medtronic whilst enabling the business to meet its goals.
• Be responsible for and provide direction to projects and initiatives. Provides guidance to staff to meet schedules or resolve technical or operational problems. Directly participates in establishing and administering many functional projects. Develops and administers budgets, schedules, and performance standards.
• Influence the development of overall objectives and long-range goals of the organization.
• Develop, plan, manage, and forecast associated cost center(s), unit costs, employee complement, capital expenditures, and charge back rates.  Lead the development of cost center budget and operational plan and manage expenses to plan.
• Evaluate, negotiate, develop, and manage preferred vendor relationships to provide Medtronic with the highest value, lowest overall cost with highest quality service globally.  Lead domestic and international vendor bidding and formal Request for Proposal processes.  Monitor contract compliance on an ongoing basis.  Evaluate pricing and quality of services against Medtronic’s requirements.
• Work cross-functionally with peers to develop and influence consistent practices related to staff development, performance management, client quality programs, cost management, and the promotion of Global Business Solutions.  Establish appropriate relationships at all levels within the organization to influence and execute strategy/operations.
• Establish and maintain strong external peer connections in the interest of cyber information sharing and collaboration. 
• Continually benchmark against relevant industries and peer groups to look for continuous improvement opportunities, new techniques and tools, and measure Medtronic against similar functions.  Develop business-relevant metrics to measure the effectiveness of the program, facilitate appropriate resource allocation and increase the maturity of the security program.
• Develop job performance plans for assigned subordinates to communicate responsibilities and expected outcomes of performance in their role.
• Review and approve future staffing and skill requirements needed for succession planning and talent management purposes.
• Maintain a strong understanding of security technologies, risks, and capabilities.
• Develop in depth understanding of business processes and business dependencies on supported technologies.
• Willingness and ability to play a hands-on technical role on the team.
• Function as backup to other GCISO Team members, where necessary.
• Other duties as assigned.

Strategy & Governance

• Develop and implement strategy, vision and plans to manage information cybersecurity risk to acceptable levels.
• Work closely with organizational leadership to understand business requirements to ensure identification of information related threats and vulnerabilities and alignment, implementation, and maintenance of controls according to risk profiles.
• Assist in the definition of KPIs and associated metrics to evaluate cybersecurity program health.
• Work closely with business and technology counterparts to understand enterprise objectives, initiatives, and cyber information security risk.
• Oversees the enterprise cyber information security risk management lifecycle including the completion of risk assessments, planning, treatment, tracking, reporting, and control, including governance oversight of key business continuity and disaster recovery programs.
• Ensures that Security Risk Analysis continues to meet evolving threat landscape and regulatory (e.g. HIPAA/Meaningful Use) requirements.
• Identifies gaps in existing programs and assists in defining remediation plans.
• Actively participates in efforts to define and implement the vision, strategies and goals for the governance, security, risk management and compliance framework and activities.
• Develop and present required documentation including business cases, cost/benefit analyses, proposals, project charters, project milestones and estimates for timeframe, budget and resources required to maintain and improve Medtronic's security, audit, and compliance posture.
• Continually benchmark against relevant industries and peer groups to look for continuous improvement opportunities, new techniques and tools, and measure Medtronic against similar functions.  Develop business-relevant metrics to measure the effectiveness of the program, facilitate appropriate resource allocation and increase the maturity of the security program.
• Develop job performance plans for assigned subordinates to communicate responsibilities and expected outcomes of performance in their role.
• Review and approve future staffing and skill requirements needed for succession planning and talent management purposes.
• Maintain a strong understanding of security technologies, risks, and capabilities.
• Develop in depth understanding of business processes and business dependencies on supported technologies.
• Willingness and ability to play a hands-on technical role on the team.
• Function as backup to other GCISO Team members, where necessary.
• Other duties as assigned.