Senior Cyber Risk & Compliance Analyst

ID

2024-1552

Category

Information Security

Position Type

Regular Full-Time

The Senior Cyber Risk & Compliance Analyst is an individual with solid hands-on understanding and experience of information security, IT governance, risk assessment, and compliance. This position provides organizational support for identifying, reporting, and managing remediation activities for key risks within the organization, ensuring that controls and activities are aligned with overall organization risk strategy. The person assists the security team in improving the security measures, user awareness program, maintaining and enforcing security policies, and ensuring compliance. Responsibilities, include but not limited to coordinating 3rd party vendor risk assessments, gap analysis across the organization, evaluating and maintaining relevant controls/metrics, as well as supporting the ongoing development, maintenance, and enforcement of security policies and standards.

• In collaboration with organization’s Cyber Risk & Compliance team, work with the team to provide vision and guidelines with applicable regulations and cybersecurity frameworks (e.g., HIPAA, PCI DSS, NIST 800).
• Assist with internal and external audit process(es) for relevant compliance matters, including but not limited to SOC2, HIPAA, HITRUST, etc.
• Collaborate to develop and implement appropriate policies, procedures, and reporting metrics to ensure the security controls and compliance requirements are met.
• Assist with designing, deploying, and maintaining organization’s GRC platform.
• Help lead and define organization’s overall third-party risk management efforts.
• Assisting in designing, testing, and executing the company’s security incident response and BC/DR plans.
• Participate in internal and external security audits and risk analysis to identify weaknesses, assess the effectiveness of existing controls, and recommend remedial actions.
• Stay current and up to date with latest security news, threats, and applicable regulations.
• Respond to internal users’ security questions/concerns, external audit requests, customers’ assessments, and appropriate compliance requirements.
• Write technical reports as needed to communicate applicable security incidents and/or potential risks.
• Work individually and in a team environment. Multitask and use time efficiently to meet project/task deadlines in a fast-paced environment.
• Other duties as assigned.

• Bachelor's degree in Information Security, Computer Science, Computer Engineering, Information Technology (or equivalent of education and work experience)
• Minimum of 4-5 years of experience in Information Security, IT Security, and/or IT Risk Management
• Proven experience in governance, risk management, and compliance within the cybersecurity realm
• Demonstrated technical skills in conducting gap analysis regarding baseline security standards
• Experience in utilizing, managing, and maintaining a commercially available GRC platform
• Knowledge of cybersecurity frameworks and relevant regulatory requirements
• Ability to develop and/or modify policies and procedures in compliance with relevant regulatory requirements and management objectives
• Understanding of IP networking, data centers, IT systems, applications, and databases
• High level of personal integrity and ability to professionally handle confidential matters
• Capable of acting calmly and managing incidents under high pressure and stress
• Capable of multitasking in a fast paced, multifaceted environment
• Ability to work well with customers, peers, and management
• Demonstrated organizational, facilitation, presentation, and project management skills with excellent written and verbal communication skills at all levels
• Proficient with Microsoft Office Suite and Office365 (i.e., Teams, SharePoint)

Preferred Education Experience, Skills and Abilities

• Master’s degree in Information Security, Computer Science, Computer Engineering, Information Technology (or equivalent of education and work experience)
• 5-7 years of experience in Information Security, IT Security, and/or IT Risk Management
• Demonstrated experience in cybersecurity frameworks, such as NIST 800 and ISO/IEC 27001/27002
• Demonstrated experience and knowledge of relevant regulatory requirements, such as The U.S. Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standards (PCI DSS)
• Previous working experience in healthcare environments
• Knowledge and experience in information security and privacy laws, general electronic health information access, release of information, and release control technologies