Information Security Analyst, FT, Days

Prisma Health•Greenville, SC

14d•Onsite

About The Position

Assists in developing, implementing and administering plans, policies and procedures, techniques, and services ensuring ongoing compliance and security of Prisma Health information resources. Assists with risk and compliance assessments and/or audits of organizational systems, SaaS, PaaS, IaaS services and processes, assists in interpreting results, and developing and communication recommendations for improvement to management. Assists with review, development and maintenance of security policies. Assists with Third Party Risk Assessments and recommends controls and monitors the effectiveness of the controls after implementation. Provides enterprise-wide, risk-based security and continuity capabilities to meet changing internal and external threat landscapes. This includes responsibility for identifying and protecting sensitive information, detecting and responding to cyber threats, and maintaining compliance with regulatory requirements and industry standards. Provides security training and awareness delivery. Performs a security advocacy role and act as a liaison with business units for issues related to information security and ongoing compliance maintenance.

Requirements

Bachelor's degree in Computer Science, Information Security, Business or related field of study.
Two (2) years technical and information security experience.
In lieu of the education and experience requirements noted above, a combination of acceptable experience, education and certifications may be considered (i.e., High school diploma and seven years of experience Associate degree and four years of experience, Master's degree and no experience).
Basic computer skills (spreadsheets, databases and date entry)
Understanding of multiple regulatory requirements and frameworks (ex. NIST, ISO, PCI DSS, HIPAA, GDPR, CCPA).
Understanding of certifications SOC 1 and 2, Hitrust and ISO 27001.

Nice To Haves

One or more certifications CISSP, CISA, CISM, CRISC, Security+ preferred

Responsibilities

Supports security awareness training to organization employees. Administer Security Awareness Training Program (research and update content, rollout, employee training participation verification, reporting on hosted LMS). Provides on-demand targeted security training supporting key initiatives.
Supports vulnerability management program to ensure vulnerabilities across the enterprise are identified and remediated. Vulnerabilities to include common infrastructure systems and services, third party platforms, vendor managed medical systems, hosted web-services and software development code vulnerabilities. Reviews and verify security patch processes to ensure all patches are applied to within policy guidelines.
Supports Governance Risk and Compliance platform. Ensure risk is accurately tracked across the enterprise. Document, review and maintain controls, control activities, conduct control mapping across multiple frameworks and regulatory requirements.
Supports third party risk and compliance assessment engagements. Perform internal system/platform risk assessments and audits. Responsible for answering security compliance assessment questionnaires and RFP's.
Supports Information Security Program to ensure enterprise level framework including defining, implementing and enforcing policies, standards and practices to protect the business, information and resources.
Assists with the implementation and management of an incident response plan and reporting process to address security breaches and respond to alleged policy violations or complaints. Participates on the incident response team to contain, and investigate incidents then prepare a plan to prevent future similar incidents.
Assists with development of information security reports and metrics for staff, management and executive presentations.
Assists with the development of security standards, policies and procedures and best practices for the organization.
Stays current on all regulations, laws, security frameworks and certifications. Research the latest information technology (IT) security trends and threats.
Assists technical staff to support security efforts as directed by management.
Performs other duties as assigned.