Associate Director, Cyber Defense

Screen reader users may encounter difficulty with this site. For assistance with applying, please contact hr-accessibleapplication@osu.edu. If you have questions while submitting an application, please review these frequently asked questions.

If you are currently employed or enrolled as a student at The Ohio State University, please log in to Workday to use the internal application process.

Welcome to The Ohio State University's career site.  We invite you to apply to positions of interest. In order to ensure your application is complete, you must complete the following:

• Ensure you have all necessary documents available when starting the application process. You can review the additional job description section on postings for documents that may be required.

• Prior to submitting your application, please review and update (if necessary) the information in your candidate profile as it will transfer to your application. 

The Associate Director, Cyber Defense is responsible for the strategic vision, governance, and maturation of the medical center's defensive security capabilities. Reporting directly to the OSUWMC Chief Information Security Officer (CISO), this role provides executive and operational oversight across four core pillars: governing our partner-led Managed Security Operations Center (mSOC), directing the enterprise Vulnerability Management program (encompassing IT, IoT, and medical IoT/mIoT devices), architecting a Threat Intelligence capability, and scaling the Incident Response (IR) function.

A primary focus of this role is establishing strategic alignment and seamless collaboration between OSUWMC departments, the OSU Office of Technology and Digital Innovation (OTDI), and external security vendors. The Associate Director ensures threat-driven defense by maintaining runbooks, optimizing vendor performance against SLAs, and spearheading active, measurable iterative controls validation of the Information Security and Privacy Control Requirements (ISPCR).

As a key member of the Information Security leadership team, this position requires an elevated level of autonomy, significant executive decision-making authority, and a proven track record of directly leading, mentoring, and growing technical cybersecurity teams. The Associate Director serves as a people leader responsible for driving staff engagement, fostering technical growth, and cultivating a high-trust team culture, alongside extensive experience steering third-party partners and cross-functional technical teams within a highly matrixed environment.

• Education: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent combination of education and experience.
• Experience: 7 years of progressive leadership experience in cybersecurity operations or engineering, with personnel management or supervisory experience leading technical teams.

• Regulated Environments: Experience operating cybersecurity programs in highly regulated environments such as healthcare, higher education, government, or other critical infrastructure sectors.
• Advanced Degree: Master’s degree in Cybersecurity, Business Administration (MBA), Healthcare IT, or a related field.
• Certifications: Active industry-standard certifications such as:
  • Certified Information Systems Security Professional (CISSP)
  • Certified Information Security Manager (CISM)
• Frameworks & Standards: Working knowledge of NIST Cybersecurity Framework (CSF), NIST 800-53, MITRE ATT&CK, CIS Controls, and healthcare-specific security guidance.
• Vendor Management: Proven experience establishing governance frameworks for and holding third-party managed service providers (MSSP/mSOC) accountable via strict SLAs.
• Capability Architecture: Demonstrated success building, structuring, or significantly maturing cybersecurity functions (specifically Incident Response frameworks or Threat Intelligence programs) from the ground up.
• Incident Command: Hands-on experience leading incident command structures and coordinating responses to enterprise-wide security incidents, breaches, or advanced threats.
• Vulnerability Frameworks: Familiarity with modern vulnerability management concepts (risk-based prioritization vs. raw CVSS scoring) across enterprise and clinical environments.
• Communication & Collaboration: Exceptional relationship management skills with a track record of translating complex technical threats into quantifiable business risk for senior medical center and university leadership.

Thank you for your interest in positions at The Ohio State University and Wexner Medical Center. Once you have applied, the most updated information on the status of your application can be found by visiting the Candidate Home section of this site. Please view your submitted applications by logging in and reviewing your status. For answers to additional questions please review the frequently asked questions.

The university is an equal opportunity employer, including veterans and disability.