Position Summary
Healthmap Solutions is seeking a Governance, Risk, and Compliance (GRC) Senior Analyst to drive the day-to-day activity in our information security governance, risk, and compliance program. The ideal candidate will be responsible for driving risk management and assessment efforts ensuring the integrity of PHI and adherence to information security policies, procedures, and control systems among Healthmap Solutions’ employees, associates, contractors, and business partners. This candidate will be tasked with creating IS GRC process, leveraging the in-place foundation to construct a solid and efficient program.
The Governance, Risk, and Compliance (GRC) Senior Analyst will work closely with IT, Privacy, Compliance, business clients, and external auditors to ensure Healthmap Solutions data control standards are met. The applicant chosen will be responsible for the completion of our HITRUST and SOC2 reports on an annual basis, management of the risk register, and corresponding remediation of risks identified within the register.
Responsibilities
- Mature and lead Healthmap Solutions’ Information Security Risk Management program and performance metrics reporting
- Advance the existing assessment reporting program while driving audits such as SOC2, HITRUST, and Client requests
- Lead Healthmap Solutions use of HITRUST Common Security Framework to measure and maintain the maturity of the company’s security program
- Mature and manage Healthmap Solutions’ Information Security Risk Management program and performance metrics reporting
- Respond to client assessment ad hoc questionnaires and track this effort
- Collaborate with other Healthmap Solution teams to conceptualize and create document control content and ensure compliance with the HITRUST security framework
- Other related duties as assigned
Requirements
- Bachelor’s degree in Cyber Security (or) related degree and experience
- Hands-on security professional
- Healthcare and HITRUST experience
- Five (5) + years’ experience in Information Security
- Three (3) + years managing Information Security audit activities both as assessor and/or as assessed
- Proven ability to create process for programmatic work
- Experience managing risk scoring methodologies to establish baseline risk scores against risk appetite
- Effective at performing Information Security/Information Technology risk assessments
- Experience with regulatory controls and industry best practice frameworks such as HIPAA, ISO27001/2, PCI, NIST, etc.
- Experience with GRC tools such as Archer
- Security GRC professional
- HITRUST certification, preferred
- Contract review experience, preferred
- CISSP, CISM, GIAC, or other information related certifications, preferred
Skills
- Calm and confident under pressure
- Collaboration and Conflict management
- Proven critical thinking/critical assessment capabilities
- Demonstrated experience in the third-party risk management line of work
- Ability to effectively prioritize and execute tasks in a high-pressure environment
- Ability to manage multiple work streams simultaneously
- Proven ability to work independently and as part of a team
- Strong verbal and written communications skills
- Excellent Customer service skills
Travel
Limited Travel, Scheduled per needs of the business
#LI-Remote
Skills Required
- Bachelor's degree in Cybersecurity or a related degree and experience
- Hands-on information security experience
- Healthcare and HITRUST experience
- Five or more years of information security experience
- Three or more years managing information security audit activities as an assessor or assessed party
- Experience creating processes for programmatic work
- Experience managing risk scoring methodologies against risk appetite
- Experience performing information security and information technology risk assessments
- Experience with HIPAA, ISO 27001/27002, PCI, NIST, or similar regulatory and industry frameworks
- Experience with GRC tools such as Archer
- Security GRC professional experience
- HITRUST certification
- Contract review experience
- CISSP, CISM, GIAC, or other information security certification
What We Do
Healthmap Solutions (Healthmap) is a NCQA-accredited industry leading kidney population health management company. Healthmap uses big data resources, integrated advanced technology, clinical expertise, and complex care management to improve the lives of people living with kidney disease. Healthmap also helps healthcare providers and payers achieve the value-based results they need. Our company is a diverse and growing organization committed to our clients, the patients we support, and our employees. We are champions for better health, for those who need us most.
