Info Sec Analyst

Blue Cross & Blue Shield of Rhode Island•Providence, RI

2d•$83,200 - $124,800

About The Position

Blue Cross & Blue Shield of Rhode Island is seeking an innovative, detail-oriented security professional to join its Information Security team. The role assesses, monitors, and mitigates security, privacy, compliance, and operational risks associated with third-party vendors, delegates, and AI-enabled solutions. The analyst supports the Enhanced Vendor Oversight (EVO) and AI governance programs by conducting risk assessments, reviewing vendor controls and AI use cases, communicating risk findings, supporting remediation, and helping ensure alignment with organizational policies, regulatory requirements, and industry best practices. The role involves collaboration with business and technology stakeholders, maintaining vendor and AI risk documentation, evaluating cybersecurity and AI-related controls, and keeping informed about emerging threats, best practices, and regulatory developments. BCBSRI offers in-office, hybrid, and remote schedules based on the role. Remote work is permitted only from specified states and is subject to Human Resources approval.

Requirements

At least 3 years of relevant industry experience, ideally focused on vendor management, third-party risk management, or enhanced vendor oversight tasks.
Advanced knowledge of Microsoft Office, including Outlook, Word, Excel, and PowerPoint.
Understanding of Artificial Intelligence, Machine Learning, Generative AI, and related technology risks.
Knowledge of AI governance frameworks and industry best practices.
Familiarity with the NIST Artificial Intelligence Risk Management Framework (NIST AI RMF).
Familiarity with ISO/IEC 42001 Artificial Intelligence Management Systems (AIMS).
Understanding of AI-related regulatory, privacy, security, and ethical considerations.
Strong analytical and organizational skills.
Effective oral and written communication skills.
Ability to work independently and as part of a team.
Must be a self-driven team player.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Risk Management, or a similar area of study from an accredited college or university; candidates with a high school diploma and strong industry experience or those currently enrolled in a bachelor’s degree program will also be considered.
Experience evaluating technology, cybersecurity, privacy, or third-party risks associated with Artificial Intelligence, machine learning, generative AI, or emerging technologies.
Relevant certifications such as CISSP, CISA, CRISC, or equivalent.
Experience reviewing AI vendor security questionnaires, AI governance documentation, AI model risk documentation, or AI-related control environments.
Knowledge of healthcare industry regulations and standards.

Responsibilities

Conduct security, privacy, and risk assessments of third-party vendors, delegates, and AI-enabled solutions to identify potential risks and vulnerabilities.
Collaborate with business and technology stakeholders to align third-party and AI practices with organizational policies, regulatory requirements, and governance standards.
Review and analyze security attestations, certifications, and supporting documentation, including SOC 2, HITRUST, and ISO certifications.
Maintain vendor and AI risk inventories, portfolios, engagement records, risk assessments, and related documentation.
Evaluate third-party and AI vendor controls related to cybersecurity, data protection, privacy, regulatory compliance, model governance, and secure development practices.
Provide risk mitigation recommendations and support remediation activities to improve vendor and AI security posture.
Support implementation and monitoring of Enhanced Vendor Oversight (EVO), AI governance requirements, standards, and risk management processes.
Stay informed about emerging threats, industry best practices, regulatory developments, and evolving risks related to third-party security, AI, and technology governance.