MAIN DUTIES AND RESPONSIBILITIES

SPECIFIC

1. Maintain a comprehensive and up-to-date inventory of all operational technology (OT) assets and submit this list monthly to the NHG MDOT taskforce.
2. Track devices across their full product lifecycle — procurement, deployment, operation, maintenance, and decommissioning.
3. Advise both technically and in layman terms to both internal and external stakeholders, the technical essence and nature of potential and associated cybersecurity risks for facilities M&E systems and equipment.
4. Perform risk assessments together with the trades and their vendors for devices at different lifecycle stages to identify vulnerabilities.
5. Devise solutions and methods to mitigate such risks to negotiate and see through with vendors directly to effect good outcomes and balance between strict compliance and operational needs.
6. Oversee, report, account and ensure progress per the workgroup committee directives and requirements to FE fulfilment of its respective MDOTs target goals, including representing FE in such workgroups to front TTSH FE efforts and present achieved results in such endeavours to management.
7. Ensure vendor and third-party compliance during acquisition, onboarding, and decommissioning of devices.
8. Coordinate with the trades and their vendors to deploy and manage firewalls, intrusion detection/prevention systems and anomaly detection tools for OT networks.
9. Coordinate with the trades and their vendors to implement network segmentation and access controls to protect devices from external and internal threats according to Healthtech Instruction Manual (HIM) policy requirements.
10. Coordinate with device manufacturers/vendors to ensure security updates and patches are applied in a timely manner otherwise ensure device manufacturers/vendors submit deviations for approval.
11. Participate in the identification, reporting, and investigation of OT security incidents
12. Support root cause analysis and recommend corrective/preventive measures.
13. Ensure compliance with HIM’s incident escalation and reporting framework.
14. Assist in business continuity planning and system recovery procedures to minimize downtime of critical devices.
15. Carry out periodic internal audits and prepare for external audits or regulatory inspections.
16. Document with Works instructions (WI) and update standard operating procedures (SOPs) for device security and risk management.
17. Liaise with vendors and contractors to validate their compliance with HIM, cybersecurity, and hospital-specific requirements.
18. Provide technical guidance and training to trade engineers and technicians on secure use and handling of devices.

GENERAL

1. Assist the Department in drafting of policies, procedures, work instructions and continuous improvements.  
2. Any other duties as assigned.
3. Inculcate a working environment of collegiality and effective teamwork.