Job #: 2804
Title: Information Security Analyst
The Information Security Risk Analyst is responsible for Cyber Security risk management, policies and education. This individual is a member of the “Governance, Risk and Compliance” unit within the Cyber Security & Risk Management (CSRM) department. The candidate will ensure security and compliance for the public and private cloud, IAM, provide oversight, and direction to ensure cyber risk and audit findings are managed and communicated. This individual will assist in developing and maintaining the Business Continuity Planning and security awareness programs that are aligned with the client and department objectives, HIPAA, NIST and organization’s risk profile. Additionally, this role will be responsible for project managing cybersecurity projects.
PRINCIPAL DUTIES AND RESPONSIBILITIES
Understand the opportunities and challenges facing business, mission, IT, and operational groups and be able to balance institutional risk with business and mission objectives. Design and implement mechanisms to monitor adherence to strategies and policies and take corrective action as needed.
Act as a SME for end to end management of findings for information security assessments for vendors, applications and biomedical devices. Adhere to NIST Cyber Security Framework, HIPAA, Joint Commission. Meaningful use of audits and purple team/penetration/vulnerability assessment findings.
Act as a SME for Cyber Security audits performed by external clients.
Maintain a formal risk register which drives security governance and ensures security funding is aligned with business objectives.
Develop Key Risk Indicators which highlight top cyber risks for the organization to executive management and the board and Key Performance Indicators that demonstrate success of the security program along with its alignment to NIST and industry best practices.
Work collaboratively with the other Managers, Directors, CMIO, CIO, Service Line Leads, Steering Committees and other key partners to manage Cyber Security risks.
Assist in developing and contributing to a formal next generation security education and awareness program that delivers role-based security education, is based on gamification concepts and leads to measurable improvement in building a risk aware culture at all levels. Create and deliver information security concepts in simple and engaging manner through newsletters, social media, blogs, video, new employee orientation, townhalls and in person.
Assist in developing and building a GRC tool to track and manage cyber risks for the organization/
Act as PM for all cybersecurity related projects. Additionally, work closely with the Project Management Office (PMO) and other IT teams to define security, requirements, track issues and concerns, provide solutions, communicate identified vulnerabilities, and identify exceptions to policy. Ensure that PMO policies, procedures, forms, and workflows include appropriate security components so that projects incorporate appropriate risk-management and mitigation techniques and tasks.
Bachelor’s degree from an accredited school
5-7 years of security experience and project management experience.
At least 3 years working in a regulated industry (healthcare preferred).
At least 1-2 years implementing/using a GRC platform such as Lockpath, Archer, RSAM, ServiceNow or any other (Lockpath is a plus).
At least 1-2 years dealing with public cloud (AWS/Azure/O365) security and compliance.
Strong knowledge of frameworks such as NIST Cyber Security Framework, Cloud Security Alliance, Center for Internet Security, COBIT and FedRAMP.
Working knowledge of HIPAA and HITECH. Strong analytical and problem solving skills.
Proficient in using project management and presentation tools (ie, Microsoft Project, Excel, Powerpoint).
Excellent written and verbal communications skills, interpersonal skills. Must possess a high degree of integrity and trust along with the ability to work independently as well as motivate others.
CISSP, CISM, C-RISC, CISA or other similar certifications.