Information Security and Risk Analyst

HealtheConnections•Syracuse, NY

2h•$70,000 - $85,000•Hybrid

About The Position

HealtheConnections is seeking an Information Security and Risk Analyst to strengthen its enterprise security and compliance program. The role focuses on the day-to-day operation of the security program, including identifying and documenting risks, coordinating vendor security reviews, supporting regulatory compliance and audits, tracking remediation, and keeping the organization audit-ready. The analyst will work with internal teams, business partners, vendors, and technical teams to improve security processes and protect sensitive healthcare information. This position is not a hands-on IT troubleshooting, networking, security-tool configuration, help desk, or desktop support role. It emphasizes organized, well-documented, repeatable processes; effective collaboration; and following security issues through resolution. HealtheConnections describes its environment as collaborative, high-performing, high-energy, and casually competent, with work that supports healthcare professionals and communities across New York State.

Requirements

At least 3 years of experience in Information Security, IT Risk, Compliance, Audit, or a related field.
Experience supporting vendor risk assessments, audit activities, security documentation, or remediation tracking.
Proven success as the primary manager of a vendor relationship.
Strong organizational and project management skills, including the ability to prioritize competing demands and follow through on outstanding tasks.
Ability to stay organized, manage multiple priorities, and build repeatable processes while maintaining detailed documentation.
Ability to communicate effectively with technical and non-technical stakeholders.
Critical thinking and problem-solving skills with a risk-based mindset.
Ability to drive projects proactively to completion and collaborate across departments with attention to detail.

Nice To Haves

Working knowledge of HIPAA and healthcare security requirements.
Familiarity with security frameworks such as the NIST Cybersecurity Framework, HITRUST, OHIP, or similar governance frameworks.
Security certifications such as Security+, CySA+, CISA, CRISC, or similar, or progress toward certification.

Responsibilities

Conduct third-party security reviews and risk assessments using vendor documentation and/or discussions; document findings, coordinate remediation with technical teams, track issues through resolution, and report results to management.
Review vulnerability scans and penetration test results; work with vendors, security partners, and service providers to investigate security concerns, gather information, track open issues and remediation, and ensure third parties meet organizational security requirements.
Maintain security risk registers and other documentation, including Plans of Action and Milestones (POA&Ms), by documenting identified gaps, assigning remediation actions, tracking deadlines, and following up on outstanding items.
Maintain security and compliance requirements for HITRUST, OHIP, and other applicable security initiatives.
Develop and update security policies, procedures, and operational documentation to reflect current security practices, compliance requirements, and organizational process changes.
Compile security metrics, dashboards, and reports communicating risk trends, outstanding vulnerabilities, remediation progress, and compliance status to internal stakeholders.
Support security awareness and communications by preparing security reminders and distributing updates on security practices, policies, and emerging risks.