OHR Security Assurance Architect

Security Assurance Architect

HSE One Health Record Programme – Technology Transformation

Remote working but required to attend in-person meetings when needed. 

Sláintecare is the underpinning 10-year strategy for the Irish health service and identifies the implementation of an Electronic Health Record (EHR) as essential to the delivery of truly integrated care. Integrated care is central to the Sláintecare vision and is dependent on connected data flows that enable the delivery of the right care, in the right place, at the right time, by the right team.

 

Digital for Care is the Government-approved digital strategy for the Irish health service and includes a commitment to implement a National Electronic Health Record. This EHR will be a key enabler in achieving the Sláintecare objective of integrated, person-centred care across health and social care services.

 

The HSE One Health Record (National EHR) aims to:

·       Improve the quality and consistency of care delivered to patients by increasing adherence to national standards of care and enabling audit and quality improvement.

·       Empower patients to better understand and manage their own health by providing access to a unified, lifelong healthcare record.

·       Transform the delivery of health and social care, supporting improved health outcomes through a comprehensive, shared record and enabling coordinated and shared management of care.

·       Enhance patient safety and care quality by providing healthcare professionals with timely access to accurate and relevant clinical and social care information, and by facilitating collaboration across care settings and disciplines.

·       Increase efficiency and improve the user experience for care providers by reducing duplication, minimising reliance on paper records, and enabling clinicians to spend more time on direct patient care.

·       Strengthen health intelligence, population health planning, and clinical research, through the capture of comprehensive information across all publicly funded healthcare services and the secure exchange of key information with other care providers.

·       Increase the agility and responsiveness of the health service, supporting the ongoing implementation of Sláintecare, adapting to evolving healthcare needs, and improving service management through an enterprise-class EHR supported by a skilled and well-resourced workforce.

·       Foster a digital health ecosystem and learning health system, by engaging with a wide range of stakeholders to support innovation and continuous improvement.

·       Rationalise the existing technology landscape, by delivering a single, national EHR solution to replace the majority of current legacy systems.

 

Primary reporting relationship will be to the OHR Cyber and Security Work Programme Lead.

The Security Assurance Architect will act as an embedded member of the One Health Record programme working alongside the Technology Transformation team.

The HSE One Health Record Programme team is responsible for the day-to-day management of the programme. The size and organisation of the HSE One Health Record Programme Team will evolve throughout the programme, but in overview it focuses on the following areas:

 

Ø  Programme Management

Ø  Change Management

Ø  Application Delivery

Ø  Technical Delivery

 

There are several functional teams within the EHR Programme managing specific areas of work:

 

Ø  PMO:

o  All elements of the ongoing central management and reporting for the Programme. 

Ø  Procurement:

o  Preliminary market consultations, development of tender documentation, supplier dialogue and negotiations including ongoing vendor management.  

o  Procurement of EHR applications services, hosting contract and enabling services.  

Ø  Health Service Transformation:

o  Provides oversight and leadership to the Service Design Teams responsible for the functional and non-functional requirements of the EHR.

o  Standardisation of workflows, aligning clinical needs, and best practice. 

o  Leading on national change and operational readiness, supporting continuous improvement for programme delivery.

Ø  Workforce:

o  Assesses future workforce needs aligned to the EHR implementation. 

o  Leads the delivery of targeted recruitment activities to support the Programme nationally and regionally.

o  Leads the development of the overall training strategy for the OHR Programme.

Ø  Communication and Engagements:

o  Develops and manages Programme communications, national and regional stakeholders' engagement.

o  Develops communications products and content for a range of audiences in line with Programme strategy.

Ø  Technology Transformation:

o  Oversees EHR architecture design, capturing the infrastructure requirements of the Programme and managing interdependencies with other HSE Programmes.

o  Defines the EHR data and reporting requirements, aligned to HSE data strategy.

o  Develops the OHR integration strategy and requirements for ICT systems and medical devices.

Role referred: Security Assurance Architect

·       This is a delivery-facing technical role. The post holder will review architecture and design artefacts, conduct threat modelling and risk assessments, and provide practical, proportionate security guidance directly to programme architects, delivery teams and suppliers as the OHR Programme moves through procurement and into implementation.

·       The role requires current, active security architecture experience rather than programme assurance or governance leadership experience alone.

·       The post holder will spend the majority of their time on technical review and design work, operating as part of the OHR Cyber and Security Work Programme team and providing guidance and review to colleagues and delivery partners, rather than directing programme-level governance forums.

The principal duties of the Security Assurance Architect include but are not limited to: 

 

1.     Main duties and responsibilities

Architecture Review & Design Input

o   Review proposed OHR architectures, designs and supplier solutions to confirm that security requirements, risks and controls are appropriately addressed.

o   Conduct structured security architecture reviews of solution designs, integrations and architectural artefacts, providing written and verbal findings.

o   Produce clear, practical security architecture recommendations to support secure design and implementation decisions.

o   Support the development of secure high-level and low-level designs for OHR applications, cloud services, infrastructure, integrations and identity-related solutions.

 

Risk & Threat Analysis

o   Conduct threat modelling, vulnerability analysis and technical risk assessments across OHR systems, supplier dependencies and integrations.

o   Identify security risks, design weaknesses and control gaps, and recommend proportionate mitigation measures.

o   Monitor the relevant threat landscape and advise on actions required to maintain a defensible security posture for OHR.

 

Standards, Patterns & Compliance

o   Develop and maintain security architecture standards, design principles, reference patterns and supporting guidance for the OHR Programme.

o   Support compliance with the NIS2 Directive, Cyber Resilience Act (CRA), GDPR, Data Protection Act 2018, ISO 27001, NIST CSF and HSE cyber security policy.

o   Provide security input to procurements, technical evaluations and third-party/supplier solution reviews.

 

Stakeholder Engagement

o   Work closely with OHR architects, delivery teams, Information Asset Owners and suppliers to embed security into design and delivery.

o   Explain technical security findings clearly to both technical and non-technical stakeholders.

o   Contribute security findings and recommendations to programme governance forums and design authorities as required (in a supporting and assurance capacity).

 

Documentation & Continuous Improvement

o   Maintain accurate security architecture documentation, review records and risk registers.

o   Support internal and external audits by providing evidence and contributing to remediation plans.

o   Contribute to continuous improvement of OHR security architecture standards and assurance methods.

 

Experience:

Applicants must demonstrate, by the closing date indicated: 

•       Significant current, hands-on experience in security architecture, cyber security engineering or solution architecture (not solely GRC or assurance oversight).

•       Demonstrable recent experience reviewing and advising on security architecture for complex digital, cloud or integration-heavy solutions.

•       Experience producing technical security artefacts: threat models, risk assessments, design reviews, architecture patterns.

•       Strong working knowledge of NIS2, ISO 27001, NIST CSF and GDPR (or equivalent regulatory frameworks).

•       Experience with cloud and hybrid security architecture (Azure, AWS), identity and access management, and network security design.

•       Strong written and verbal communication skills, with the ability to translate technical findings for non-technical audiences.

 

Health

A candidate for and any person holding the office must be fully competent and capable of undertaking the duties attached to the office and be in a state of health such as would indicate a reasonable prospect of ability to render regular and efficient service.

Character

Each candidate for and any person holding the office must be of good character.

Access to appropriate transport to fulfil the requirements of the role as this post may involve travel at times. 

 

At go-live period only (for approx. six weeks) participate in a roster covering 24/7 shifts and/or an on-call rota

The successful candidate will be required to demonstrate the following skills:

•       Experience in security architecture or assurance for healthcare, EHR or other critical national infrastructure programmes.

•       Familiarity with health interoperability standards: HL7 FHIR, HL7 v2, IHE profiles, openEHR.

•       Experience embedding security into DevSecOps and secure-by-design software delivery pipelines.

•       Practical experience with relevant tooling: threat modelling tools (e.g. Microsoft Threat Modeling Tool, OWASP Threat Dragon), vulnerability scanning (e.g. Nessus), SIEM platforms, Azure AD/Entra ID, ServiceNow GRC, Visio or equivalent.

•       Relevant professional certification (e.g. CISSP, CISM, SABSA, TOGAF, CCSP) advantageous.