Healthcare Industry Career Search Panel

This Higher Ground panel at BSides Las Vegas 2021 brought together two healthcare security practitioners to talk about building careers in the sector. The moderator opened by asking how each panelist arrived in the field. One came from health policy and privacy work and became a lawyer focused on health data. The other started as a penetration tester and vulnerability researcher, later worked on medical device security at a large manufacturer, and eventually founded a company that serves healthcare providers.

The middle of the discussion covered what sets healthcare apart. Medical equipment often stays in service for decades and runs older operating systems that cannot easily be patched or loaded with security tools. Regulation of device vendors and electronic health record vendors also differs from other industries, which shapes how risk is managed. The panelists stressed learning how clinical operations, payers and providers, and regulations such as HIPAA actually work, and being patient with colleagues who are not security specialists. They were skeptical about certifications and pointed to professional groups and industry events as better ways to meet the people in the field. They also noted that hospital security teams offer broad early-career experience, and that product security and device research roles are growing.

For newcomers, the advice was to ask practitioners how they run their playbooks and to keep up with news and peer discussion. Experienced security professionals moving into healthcare were urged to learn the business first and stay humble. The panel closed by encouraging listeners to reach out to people already working in the field.