Community Health Alliance is looking for full-time Information Security Manager (ISM/HIPAA Security Officer). Join our talented team of IT that focus on serving the community and helping those in need by creating healthy outcomes for patients of every income.

We operate six convenient locations throughout Reno and Sparks, providing comprehensive, top-quality medical services, dental and pediatric care, behavioral health, low-cost pharmacies, nourishing food pantries, and more.

Position Summary:

The Information Security Manager (referred to as ISM hereafter) owns, develops, implements, and continuously improves the organization's Information Security Program to protect internal information systems, sensitive data, and electronic Protected Health Information (ePHI).

This position serves as the organization's designated HIPAA Security Officer, responsible for implementing and managing the technical and administrative safeguards required under the HIPAA Security Rule. The Information Security Manager is the organization's technical security authority, accountable for cybersecurity governance, risk assessments, security operations, incident response readiness, and the administration and oversight of enterprise security technologies.

This is both a strategic and hands-on role within a lean IT environment, providing leadership, governance, monitoring, and direct operational support across Microsoft 365 technologies (Entra ID, SharePoint, Teams, OneDrive, Purview) and related cybersecurity platforms such as Arctic Wolf and Netwrix.

The ISM represents the organization in collaboration with the Health Center Controlled Network (HCCN), Primary Care Association (PCA), and peer Federally Qualified Health Centers (FQHCs) to address evolving cybersecurity risks, regulatory requirements, and emerging technologies.

Collaboration

The ISM collaborates closely with the Quality Improvement & Compliance Director, HIPAA Privacy Officer, Risk Manager, Information Technology leadership, General Counsel, and Executive Leadership to ensure alignment of information security, regulatory compliance, HIPAA privacy, and enterprise risk management activities.

Education

· Bachelor's degree in Information Security, Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience).

Experience

· Minimum of 5 years of progressive experience in cybersecurity or information security roles; 7+ years preferred.

· At least 2 years in a security leadership, governance, healthcare security, or HIPAA Security capacity (3+ years preferred).

· Experience in a HIPAA-regulated healthcare environment strongly preferred.

· Experience with MDR platforms (e.g., Arctic Wolf) and Microsoft 365 security tooling preferred.

Preferred Certifications

· CISSP, CISM, or CISA

· Microsoft Security Certifications (SC-200, SC-300, SC-400)

· HCISPP (Healthcare Information Security & Privacy Practitioner)

Key Performance Indicators (KPIs)

· Completion of the annual HIPAA Security Risk Analysis and documented mitigation plan.

· Percentage of high-risk vulnerabilities remediated within defined SLA timelines.

· Mean time to detect and respond to security incidents.

· Phishing simulation program coverage, frequency, and year-over-year improvement trend.

· Security program maturity (e.g., NIST CSF tier progression measured via annual assessment).

· Year-over-year reduction in residual risk on the cybersecurity risk register.

· Completion of security roadmap milestones against the multi-year security program plan.

· Incident response performance - percentage of incidents handled per playbook and timely closure of post-incident corrective actions.

· Completion of scheduled tabletop exercises and documented remediation of identified gaps.