Position Purpose: Under the direction of the Information Security Director, the information security engineer administers the design and implementation of application systems for use within Renown Health entities. This position provides information security’s technical requirements related to the protection of information assets and resources to Information Resources (IR), customer communities, and affiliated business partners. The incumbent participates in providing technical, data protection solutions to other departments to help resolve their business needs.
Administers the design, implementation, and management of Information Security hardware and software systems related to custom solutions provided by vendors requiring secure access to their applications, databases, and clinical modalities for use across areas of Renown Health entities. This position works with members of the IR teams and with the user community to provide solutions that meet overall functional needs relating to information technology, remote access, and application systems. Also helps ensure technical problems and application performance issues are addressed, typically working through other members of the teams. The incumbent has authority to work with assigned clinical and business areas to reach agreement on solutions and/or recommendations for infrastructure and architecture solutions in providing solutions and on-going support to support business and clinical needs.
The Information Security Engineer provides analyses, design, build, installation, implementation, documentation, and maintenance of Information Security requirements within the IR infrastructure and network teams of Renown Health; to work closely with business units, IR teams, and Vendors to gather requirements; to ensure proper testing and validation of information security requirements on the finished product; to participate in the resolution of infrastructure challenges; to perform IT security analysis and modeling utilizing a variety of systems; to provide analytical support on various strategies to ensure company goals are met; and to propose improvements in infrastructure and architecture requirements to support the organization’s requirements and goals.
This position will serve as the lead in performing annual Information Technology risk assessments to meet Meaningful Use Criteria 15 and HIPAA Security requirements. In addition, the Information Security Engineer will assist in the prioritization and then facilitate the remediation of technical vulnerabilities identified by the risk assessment with the affected IR units and business administrators.
The Information Security Engineer will perform external and internal penetration testing to identify externally-facing and internal vulnerabilities. The Information Security Engineer will assist in the prioritization and then facilitate the remediation of those realized, technical vulnerabilities.
The Information Security Engineer position is responsible for ensuring information security administration within the Renown Health System’s enterprise wide data and video network infrastructure, servers, business computers, and business applications (including interfaces between applications. This includes the strategic planning, design, and the compliance assurance during pre-implementation, implementation, and post implement for all local and wide area networks (LANs and WANs) and equipment, applications, vendor-provided and vendor-supported solutions; cost analysis, vendor technology evaluation, project management (coordinated with business units and other IR teams); planning, implementation and support for network security (coordinated with IR Infrastructure); acting as a subject matter expert on networks, network issues, servers, server issues, desktops, desktop issues, and security concerns; acting as a trainer and mentor to lower level Information Security analysts and engineers; providing technical support to other Information Security team members; and interfacing with equipment vendors to evaluate and validate emerging technologies.
Nature and Scope: The incumbent will be responsible for supporting a variety of Information Security and remote access software applications and development tools that may include, but is not limited to: Security Incident & Event Management, Intrusion Detection/Intrusion Prevention, Vulnerability Assessment Scanner, Web & Content Filtering, proprietary remote access management consoles, Microsoft Office, MS SQL and other relational database systems, Visual Studio.NET (C#, ASP.NET, etc.).
This position works directly with the IR WAN and LAN teams to design and develop automated solutions for departmental and functional requirements. This includes infrastructure design, pathways, system flows, interfaces, report design, system documentation and recommendations for alternate log management, system scanning, and remote access support software and accesses.
The incumbent will provide accurate and timely project status reporting to ensure compliance with established timeliness and recording of allocated work hours. All variances from established schedules must be recommended to and approved by the Information Security Director.
The job function requires an ongoing direct communication with Managers and Directors in all departments, and the ability to analyze user requirements and generate report specifications as well as the ability to translate data into business context.
This position also acquires and maintains comprehension of industry specific knowledge to initiate, coordinate, and provide expertise in WAN infrastructure (wired and wireless), servers (HP Large Systems (HP-UX), IBM Power Systems AIX servers, and Windows Intel Servers, HP-Unix operating systems software, IBM AIX operating system, Linux, etc.), applications (clinical, financial, business, etc.) and architecture information security projects.
This position will have access to confidential, personal, protected health, and propriety information. This mandates high standards of professionalism, communications, performance, and respect for confidentiality.
The major challenges of this position are to identify and resolve problems to ensure the efficient function and uninterrupted operation of the information security computer systems and tools; maintain a wide variety of installed software; plan for short and long range software and hardware requirements and implement new software and hardware. This position requires organizational skills to manage multiple unrelated work projects and meet deadlines while maintaining efficiency and stability of the operational production systems.
This position has the authority under general supervision to determine and modify operational parameters to ensure efficient performance of the programs and systems, determine and request available computer resources and recommend deadlines relative to maintaining the systems performance and stability. Decisions that must be referred to the supervisor include software or hardware acquisitions, personnel management, policy deviations, financial matters and changes that could adversely impact system performance or integrity.
This position is part of a data center team that supports a 24×7 production environment. Off-hours support and weekend work may be required.
Additional duties may include working with an outside vendor to provide or collect data or perform system updates as needed.
The Information Security Engineer will be responsible for a complex, wide-area network that is rapidly changing to support enterprise growth and development of new business opportunities. The technician is challenged with providing an environment that is reliable, flexible and cost effective.
Additional responsibilities and flexible working hours may be required.
KNOWLEDGE, SKILLS & ABILITIES:
1. Knowledge of IBM AIX, HP-UX (prefer HP-UX, 11.11 and above), Linux, and Windows operating systems.
2. Experience with HP-UX, Linux, and Windows monitoring, logging, and reporting skills.
3. Strong general Unix Administration skills.
4. Working knowledge of command language programming (UNIX Script, VB Script).
5. Knowledge and experience with the use of TCP/IP.
6. Knowledge and experience with Storage Area Network (SAN, NFS) and utilization of various storage protocols, connectivity, and fabric switches.
7. Familiar with server backup and recovery practices.
8. Experience with HP-UX, Linux, and Windows Disaster Recovery practices and processes.
9. Organization skills and knowledge of project management tools to assist with the initiation coordination and control activities related to the installation, implementation and maintenance of integrated software products and processes.
10. The ability to apply analytical skills and logical reasoning to resolve problems without causing prolonged or continuous loss of computer production or performance.
11. The ability to read and interpret computer documentation, run instructions, hardware operating manuals and user documentation.
12. The ability to work as part of a team or work independently depending on the job situation.
13. Flexibility to adjust to changing job priorities.
14. Ability to provide training and instruction to peers and users of supported computer programs and processes.
15. Knowledge of interface engines and protocols. Experience with HL7, X12 and/or XML and OPENLink are a plus. Applicants with these skills and knowledge in the Healthcare field or with Hospital Information Systems desired.
16. Familiarity with PC software including databases, spreadsheets, word processing, MS Project, and other applications.
17. General knowledge of data security techniques. Must be able to follow HIPAA standards for properly securing patients’ Protected Health Information.
18. Working knowledge of Information Security’s ten domains.
19. Demonstrate strong analytical skills and problem solving techniques. Ability to apply these skills and techniques by providing business solutions in an integrated healthcare delivery system or health insurance organization. Previous working knowledge in healthcare field highly desired.
20. Demonstrate high level of accuracy on production work and documentation development.
21. Excellent written and verbal communication skills required for user interaction and timely and accurate systems documentation.
22. Philosophy consistent with the Renown Health System Purpose Statement and Information Protection’s purpose statements.
23. Previous experience with health information systems, electronic medical records and/or interfaces desired.
This position does not provide patient care. The foregoing description is not intended and should not be construed to be an exhaustive list of all responsibilities, skills and efforts or work conditions associated with the job. It is intended to be an accurate reflection of the general nature and level of the job. Minimum Qualifications: Requirements – Required and/or Preferred Education: Must have working-level knowledge of the English language, including reading, writing and speaking English.
Bachelor’s degree in Management Information Systems, Business, Computer Science, Healthcare Administration or other Healthcare field is required. Experience: Minimum five years experience with wide and local area networks. Background in a Health Care System environment is preferred. Experience with network management tools and configuring network equipment.
- Four years experience as a system administrator of a UNIX environment; or a combinations of three years experience as an applications programmer and a systems administrator in a HP-UX, AIX, Linux mid-range, or Windows Server environment.
- Minimum of five years experience with application design, development and maintenance or system implementation, configuration and support. Preference will be given to individuals with experience in healthcare systems.
- Experience in large systems environment with HP-UX. Experience in Storage Area Network connectivity. System administration experience with Epic health care system.
License(s): None. Certification(s): Recommended (not required):
CCNP (Cisco Certified Network Professional)
Capable of obtaining a Certified Information Security Systems Professional (CISSP), Systems Security Certified Practitioner (SSCP), Certification and Accreditation Professional (CAP), Systems Security Certified Practitioner (SSCP), Certified Information Systems Auditor (CISA), or Microsoft Certified Systems Administrator (MCSA). Ongoing maintenance of certification is required for continued employment. Computer / Typing: Must be proficient with Microsoft Office Suite, including Outlook, PowerPoint, Excel, Access and Word and have the ability to use the computer to complete online learning requirements for job-specific competencies, access online forms and policies, complete online benefits enrollment, etc. Typing 45 WPM.