GRC Analyst

RxBenefits, Inc.•Birmingham, NV

1d•$80,800 - $101,000•Remote

About The Position

The GRC Analyst coordinates and independently executes corporate compliance initiatives, working closely with security and compliance teams to implement and execute RxBenefits’ compliance vision. The role requires strong program and project management skills, attention to detail, and the ability to manage multiple priorities. The analyst supports enterprise risk management and security controls, conducts risk assessments, maintains the GRC platform, and reports security risk to executives. The role also supports internal and external audits, assesses control deficiencies, responds to client security questionnaires and audit requests, manages third-party vendor assessments and compliance, and assists with developing policies, procedures, and standards. This is a remote-first role.

Requirements

Bachelor’s degree or relevant equivalent experience.
At least 3 years of Audit, Risk, or Compliance experience.
At least 3 years of experience with HIPAA regulatory controls, SSAE, SOC 1, and SOC 2.
Ability to manage multiple work efforts and quickly change direction.
Ability to work in detail while also assessing broader populations to identify connections, themes, risks, and concerns.
Sound organizational, analytical, oral, and written communication skills, including the ability to influence management and lead change in strategic and tactical initiatives.
Self-starter with a desire to learn, ability to teach others, high energy, positive attitude, and flexibility.

Nice To Haves

At least 5 years of experience with IT general controls and other IT controls aligned with frameworks such as NIST, ISO, and COBIT.
Healthcare industry experience.
Experience working with external audit firms.

Responsibilities

Identify and maintain a list of high-value assets and their associated threats and vulnerabilities with RxBenefits teams to support effective risk mitigation.
Document and maintain enterprise processes that reduce security risk, and work with organizational partners to design and mature security controls.
Perform routine or ad hoc security risk assessments as needed or in response to management requests.
Assist in maintaining the GRC platform, including documentation of controls, risk information, and related details.
Produce periodic security risk views and reports to inform executives about program health and the company’s risk position.
Prepare for and assist with responses to internal and external audits.
Evaluate the impact of audit control deficiencies and refine deficiency documentation to identify actionable business impact.
Work with RxBenefits clients to respond to security questionnaires and audit report requests.
Use judgment and critical thinking to influence business partners.
Help business partners balance business strategy with appropriate risk management controls.
Stay up to date with audit and compliance trends.
Manage third-party vendor assessments and compliance.
Assist with developing policies, procedures, and standards.
Perform other duties as assigned.

Benefits

Remote-first work environment.
Choice of an HDHP or PPO medical plan; the company pays 100% of the HDHP premium for the teammate and eligible family members.
Dental, vision, short- and long-term disability, and group life insurance, with 100% of premiums paid by the company; family coverage is included for dental and vision.
Additional buy-up options for short- and long-term disability and life insurance.
401(k) with an employer match up to 3.5%, available after 60 days.
Community Service Day.
10 company holidays, including MLK Day, Juneteenth, and the day after Thanksgiving, plus a floating holiday.
High-speed internet reimbursement and company-provided computer and monitors.
Tuition reimbursement for accredited degree programs.
Paid New Parent Leave that can be used for adoption or birth.
Pet insurance.
Mental health benefit and EAP service through Spring Health.