Information Risk and Compliance Specialist-FT-Information Services-Provo

Revere Health•Provo, UT

7d•Hybrid

About The Position

The Information Risk & Compliance Specialist supports privacy, security, and information-risk management in a healthcare environment by helping assess control effectiveness, track remediation, support incident investigations, and coordinate compliance activities across technical and business stakeholders. This role is best suited for a candidate with practical experience in healthcare compliance, information risk, privacy, or security operations who is comfortable working with technical teams, interpreting findings, and driving issues to resolution. The successful candidate will bring structure, accountability, and steady progress to a growing information risk management program.

Requirements

Bachelor’s degree or equivalent experience in information systems, information security, healthcare administration, compliance, or a related discipline.
Three or more years of experience in healthcare information risk, privacy, compliance, security operations, audit support, or a closely related GRC role.
Experience working with technical and operational stakeholders to identify, track, and close security or compliance gaps.
Working knowledge of HIPAA Privacy and Security requirements.
Familiarity with risk assessments, control validation, audit evidence, and remediation tracking.
Ability to understand technical findings, assess their operational impact, and communicate them clearly to varied audiences.
Strong written and verbal communication skills.
Strong critical thinking, organization, and follow-through.
Ability to handle confidential information with sound judgment and discretion.
Experience working in a regulated healthcare environment.
Ability to travel periodically (Intrastate) to assess risk and compliance at remote clinics.

Nice To Haves

Direct experience in healthcare information security, privacy, or information risk.
Hands-on exposure to IAM, vulnerability management, endpoint security, log review, or similar enterprise security processes.
Experience supporting privacy incidents, security incidents, or breach evaluations.
Experience with GRC tools or compliance tracking platforms.
Experience with Microsoft 365, Azure, or similar enterprise technology environments.
Familiarity with PCI DSS, NIST CSF, FISMA, HITRUST, or similar frameworks.
Experience supporting audit readiness or control testing in a healthcare or regulated environment.
Familiarity with HIM workflows, clinical operations, or healthcare business processes.

Responsibilities

Maintain the compliance and information risk calendar, including key obligations, due dates, owners, evidence needs, and follow-up actions.
Track the risk register and related issue logs, ensuring items remain current, actionable, and appropriately escalated.
Work with control owners to validate status, document remediation progress, and drive closure of compliance gaps.
Identify overdue items, missing ownership, and barriers to completion, and help move issues toward resolution.
Receive, log, and organize privacy incident reports in a timely manner.
Gather facts, timelines, system details, and supporting documentation needed for investigation and decision-making.
Coordinate follow-up with IT Security, HIM, and business owners as needed.
Track investigation milestones, status updates, and corrective actions through closure.
Prepare working notes and summaries for Privacy Officer review.
Escalate potentially high-risk matters promptly.
Support internal and external audits, assessments, and compliance questionnaires.
Coordinate evidence requests and maintain audit-ready documentation.
Validate supporting evidence for controls, findings, observations, and corrective actions.
Track remediation status through completion and confirm closure documentation is complete.
Help prepare concise updates on compliance posture, open issues, and recurring risk themes.
Assist with policy, standard, procedure, and control documentation.
Help keep documentation current, clear, and aligned with operational practice.
Support version control, review cycles, and approval tracking.
Review documentation for consistency between written requirements and actual workflows.
Assist with vendor intake, risk tiering, and due diligence workflows.
Coordinate security and privacy questionnaires, follow-up requests, and remediation tracking.
Maintain visibility into vendor-related privacy and compliance risk.
Help ensure third-party obligations are documented, monitored, and followed through.
Work directly with IT Security, IT Infrastructure, HIM, Legal, Procurement, Compliance, and business units.
Facilitate follow-up on outstanding actions and unresolved issues.
Communicate clearly with both technical and non-technical stakeholders.
Support timely coordination between operational owners and control owners.
Maintain status reports, dashboards, and action trackers.
Provide concise updates on open issues, risks, incidents, and remediation.
Use data to highlight trends, aging items, repeat findings, and recurring problem areas.
Help leadership understand where technical and compliance gaps are appearing and what is needed to close them.
Perform other duties and special projects as assigned.