Risk compliance analyst - Expert In Recruitment Solutions
Water Street, NY 22102
About the Job
Title: Risk compliance analyst
Location: onsite - Water Street in New York
Key Responsibilities:
A minimum of seven years of IT experience, least 5 years dedicated to IT Security Risk Management, Risk Audit/Assessment, and/or Security and/or Data Privacy Investigation least two years in a supervisory capacity
Location: onsite - Water Street in New York
Key Responsibilities:
- Support Information Security and Risk Management by maintaining and enforcing the Information Security and risk management framework/methodology, including execution of risk analysis and risk mitigation strategies.
- Manage the process of gathering, analyzing and assessing the current and future threat landscape, as well as providing the CISO with a realistic overview of risks and threats in the enterprise environment.
- Exhibit best practice risk management skills through effective internal risk controls, risk monitoring, risk assessment and improvement of risk management processes.
- Document and maintain the enterprise security risk governance methodology and risk management policy, process, and procedure.
- Work with various stakeholders to identify information asset owners to classify data and systems as part of a control framework implementation.
- Organize and perform the enterprise security risk assessment and gap analysis for all technologies, products, and functions introduced, including maintaining risk project work plans to measure and manage progress.
- Track and document all internal risk reviews, assessments, risk acceptances, and security exceptions in a GRC tool.
- Work with the enterprise architecture team to ensure that there is a convergence of business, technical and security requirements; liaise with IT management to align existing technical installed base and skills with future architectural requirements.
- Develop a strong working relationship with the security engineering team to develop and implement controls and configurations aligned with security policies and legal, regulatory and audit requirements
- Serve as the information security liaison and subject matter expert for all relevant EMR and PHI related security risk.
- Conduct or participate in all relevant audits and risk assessment activities (whether operational risk, legal/compliance risk, reputational risk, or information security risk).
- Aid in the planning and execution of risk remediation activities including the identification of practical, cost-effective solutions.
- Facilitate team meetings between stakeholders, project leaders, and the Information Technology teams.
- Attend regular team, management, and project meetings and provide both verbal and written reports to the Leadership Team as required. This may include coordination with and support of an Operational Risk Committee.
- Keep informed on current threats and industry regulations.
- Healthcare industry experience required with understanding of EMR systems and data privacy issues related to PHI
- Experience with reviewing IT solution requirements and security controls implementation
- A strong understanding of the business impact of security tools, technologies, and policies.
- Knowledge and experience working with a GRC Software tool
- Strong working knowledge of HIPAA, Joint Commission, CMS, and other regulatory legislation pertinent to the healthcare industry
- Working knowledge of information security frameworks such as NIST CSF, HITECH, ISO27001/27002, PCI DSS and COBIT
- Experience in conducting and responding to information security assessments and audits.
- Strong analytical skills and the ability to resolve complex security vulnerabilities and design compensating controls
- Must possess a high degree of integrity and trust along with the ability to work independently
- Participate in special projects as needed and perform other duties as assigned
- Must be able to work independently as well as work as part of a fast-moving team
- Must be able to work at various locations, when necessary, along with working various shifts
- A bachelor's degree in information systems
- CISSP, CISA, CRISC or other relevant security qualification
A minimum of seven years of IT experience, least 5 years dedicated to IT Security Risk Management, Risk Audit/Assessment, and/or Security and/or Data Privacy Investigation least two years in a supervisory capacity
Source : Expert In Recruitment Solutions
