Information Security Analyst

Blue Cross & Blue Shield of Rhode Island•Providence, RI

23h•$83,200 - $124,800•Hybrid

About The Position

Blue Cross & Blue Shield of Rhode Island is seeking an innovative and detail-oriented security professional to join its Information Security team. This role is responsible for assessing, monitoring, and mitigating security, privacy, compliance, and operational risks associated with third-party vendors, delegates, and AI-enabled solutions. The successful candidate will support the organization's Enhanced Vendor Oversight (EVO) and AI governance programs by conducting risk assessments, reviewing vendor controls and AI use cases, communicating risk findings to stakeholders, supporting remediation efforts, and helping ensure alignment with organizational policies, regulatory requirements, and industry best practices.

Requirements

3+ years of relevant industry experience ideally focused in vendor management, third-party risk management, or related enhanced vendor oversight tasks.
Must be a self-driven, team player.
Ability to work independently and as part of a team.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Risk Management, or similar areas of study from an accredited college or university. OR a high school diploma combined with strong industry experience and/or candidates currently enrolled in a bachelor’s degree program will be considered.
Experience evaluating technology, cybersecurity, privacy, or third-party risks associated with Artificial Intelligence (AI), machine learning, generative AI, or emerging technologies is preferred.
Relevant certifications are preferred, such as CISSP, CISA, CRISC, or equivalent, but are not required.
Advanced knowledge of Microsoft Office; including Outlook, Word, Excel, and PowerPoint.
Understanding of Artificial Intelligence (AI), Machine Learning (ML), Generative AI, and related technology risks.
Knowledge of AI governance frameworks and industry best practices.
Familiarity with the NIST Artificial Intelligence Risk Management Framework (NIST AI RMF).
Familiarity with ISO/IEC 42001 Artificial Intelligence Management Systems (AIMS).
Understanding of AI-related regulatory, privacy, security, and ethical considerations.
Experience reviewing AI vendor security questionnaires, AI governance documentation, AI model risk documentation, or AI-related control environments.
Strong analytical and organizational skills.
Effective oral and written communication skills.
Knowledge of healthcare industry regulations and standards is a plus.

Responsibilities

Conduct security, privacy, and risk assessments of third-party vendors, delegates, and AI-enabled solutions to identify potential risks and vulnerabilities.
Collaborate with business and technology stakeholders to ensure third-party and AI-related practices align with organizational policies, regulatory requirements, and governance standards.
Review and analyze security attestations, certifications, and supporting documentation (e.g., SOC 2, HITRUST, ISO certifications) to assess vendor risk.
Maintain vendor and AI risk inventories, portfolios, engagement records, risk assessments, and related documentation.
Evaluate third-party and AI vendor controls related to cybersecurity, data protection, privacy, regulatory compliance, model governance, and secure development practices.
Provide risk mitigation recommendations and support remediation activities to improve vendor and AI security posture.
Support implementation and monitoring of Enhanced Vendor Oversight (EVO), AI governance requirements, standards, and risk management processes.
Stay informed on emerging threats, industry best practices, regulatory developments, and evolving risks related to third-party security, AI, and technology governance.