EITS Security Risk Analyst B (Engagement)--Remote Job

About the position Serve as a liaison between the CISO’s strategic initiatives and the IT operational teams. Translate business IT risk requirements into technical control specifications. Develop risk metrics for performance measurement and reporting. Coordinate enterprise-level security and risk management efforts. Act as a subject matter expert (SME) on information security and regulatory compliance. Responsibilities • Maintain and enforce the enterprise information security and risk management framework. • Conduct risk analysis and develop mitigation strategies. • Monitor and assess the enterprise threat landscape. • Provide realistic risk reporting to the CISO and leadership teams. • Track and document internal risk reviews, assessments, and exceptions using a GRC tool. • Document and maintain risk governance methodologies, policies, and procedures. • Ensure compliance with HIPAA, Joint Commission, DSRIP, COBIT, and State privacy laws. • Conduct and support internal and external audits (operational, compliance, reputational, security). • Serve as SME for EMR and PHI-related security risks. • Perform enterprise security risk assessments and gap analyses for new technologies and products. • Develop and manage risk remediation plans and work plans. • Identify information asset owners for data classification initiatives. • Support risk exception and risk acceptance documentation processes. • Partner with enterprise architecture teams to align business, technical, and security requirements. • Collaborate with security engineering teams to implement security controls. • Facilitate meetings between stakeholders and IT teams. • Provide written and verbal reports to leadership and committees (including Operational Risk Committee). Requirements • Minimum 7 years of IT experience • At least 5 years in IT Security Risk Management / Risk Audit / Data Privacy Investigation • Minimum 2 years in a supervisory capacity • Strong understanding of EMR systems • Strong understanding of PHI data privacy • Strong understanding of Healthcare regulatory environment • Experience with HIPAA, Joint Commission, CMS regulations • Hands-on experience with GRC tools (ServiceNow, Archer, MetricStream preferred) • Working knowledge of NIST CSF • Working knowledge of HITECH • Working knowledge of ISO 27001/27002 • Working knowledge of PCI DSS • Working knowledge of COBIT • Experience reviewing IT solution requirements and implementing security controls • Strong analytical and risk assessment skills • Ability to design compensating controls for security vulnerabilities • Ability to assess business impact of security tools and policies • Bachelor’s degree in Information Systems or related field Nice-to-haves • CISSP • CISA • CRISC • Other relevant security certifications • High integrity and ability to work independently • Strong communication and reporting skills • Ability to work in fast-moving environments • Experience participating in special projects • Ability to support various locations and flexible shifts if required