Info Sec Analyst

Blue Cross & Blue Shield of Rhode Island•Providence, RI

About The Position

Blue Cross & Blue Shield of Rhode Island is seeking an innovative, detail-oriented security professional to join its Information Security team. The role assesses, monitors, and mitigates security, privacy, compliance, and operational risks associated with third-party vendors, delegates, and AI-enabled solutions. The analyst supports the Enhanced Vendor Oversight (EVO) and AI governance programs by conducting risk assessments, reviewing vendor controls and AI use cases, communicating risk findings to stakeholders, supporting remediation, and helping ensure alignment with organizational policies, regulatory requirements, and industry best practices. The position is based within BCBSRI’s Information Security team. BCBSRI offers in-office, hybrid, and remote schedules depending on the role. Permitted states of residence, subject to Human Resources approval, are Arizona, Connecticut, Florida, Georgia, Louisiana, Massachusetts, North Carolina, Oklahoma, Rhode Island, South Carolina, Texas, and Virginia.

Requirements

At least 3 years of relevant industry experience, ideally focused on vendor management, third-party risk management, or related enhanced vendor oversight tasks.
Strong analytical and organizational skills.
Effective oral and written communication skills.
Ability to work independently and as part of a team; must be self-driven and a team player.
Advanced knowledge of Microsoft Office, including Outlook, Word, Excel, and PowerPoint.
Understanding of artificial intelligence, machine learning, generative AI, and related technology risks.
Understanding of AI-related regulatory, privacy, security, and ethical considerations.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Risk Management, or a similar area from an accredited college or university; alternatively, a high school diploma combined with strong industry experience or current enrollment in a bachelor’s degree program will be considered.
Experience evaluating technology, cybersecurity, privacy, or third-party risks associated with AI, machine learning, generative AI, or emerging technologies.
Relevant certifications such as CISSP, CISA, CRISC, or equivalent.
Knowledge of AI governance frameworks and industry best practices.
Familiarity with the NIST Artificial Intelligence Risk Management Framework (NIST AI RMF).
Familiarity with ISO/IEC 42001 Artificial Intelligence Management Systems (AIMS).
Experience reviewing AI vendor security questionnaires, AI governance documentation, AI model risk documentation, or AI-related control environments.
Knowledge of healthcare industry regulations and standards.

Responsibilities

Conduct security, privacy, and risk assessments of third-party vendors, delegates, and AI-enabled solutions to identify potential risks and vulnerabilities.
Collaborate with business and technology stakeholders to align third-party and AI-related practices with organizational policies, regulatory requirements, and governance standards.
Review and analyze security attestations, certifications, and supporting documentation, such as SOC 2, HITRUST, and ISO certifications, to assess vendor risk.
Maintain vendor and AI risk inventories, portfolios, engagement records, risk assessments, and related documentation.
Evaluate third-party and AI vendor controls related to cybersecurity, data protection, privacy, regulatory compliance, model governance, and secure development practices.
Provide risk mitigation recommendations and support remediation activities to improve vendor and AI security posture.
Support implementation and monitoring of Enhanced Vendor Oversight (EVO), AI governance requirements, standards, and risk management processes.
Stay informed about emerging threats, industry best practices, regulatory developments, and evolving risks related to third-party security, AI, and technology governance.