IT Compliance/Cyber Security Administrator

Griffin Health Services•Derby, CT

About The Position

Works with legal counsel and management, key departments, and committees to ensure the organization establishes, maintains, and, where appropriate, provides appropriate privacy and confidentiality consent, authorization forms, and information notices and materials reflecting current organization privacy-related practices and requirements. Establishes and administers a process for receiving, documenting, tracking, investigating, and acting on all complaints concerning the organization’s privacy policies and procedures in coordination and collaboration with other similar functions and, when necessary Initiates, facilitates, and promotes activities to foster information privacy awareness within the organization and related entities. Coordinates privacy safeguards with security officer to ensure consistency in development, documentation, and training for security and privacy requirements. Serve as the organization’s resource to regulatory and accrediting bodies for matters relating to privacy and security. Supports any audits concerning state or federal privacy laws or regulations. Develops and presents to management on an annual basis a report on privacy-related issues and compliance for the organization in the past 12 months. Develops a security training program. Ensures the security training program supports both the privacy training program and information security program. As part of the organization information security program, collaborates with the Privacy Officer to develop and implement security policies, procedures, and guidelines necessary to direct and carry out the objectives of the organization information security program; research and recommend new security measures for implementation; and monitor and test the security practices employed for effectiveness. Collaborates with the Privacy Officer to ensure that the following policies and procedures are in place; security policies and procedures; baselines security safeguards, risk assessment; security risk management; security administration; security of the computer network; security of computing assets; physical security; disaster recovery plan; third party service provider security due diligence and monitoring. Maintains documentation regarding levels of access granted to each information system user in the organization and reviews these levels of access periodically and when the status of the workforce member changes – controlling access, as appropriate. In coordination with legal counsel and outside vendors, as appropriate, investigates, responds to, and remediates security incidents. Coordinates with the Privacy officer as outlined in Incident Response Plan. Oversees third parties who perform technical system maintenance activities in the organization and works with legal counsel to ensure that such third parties comply with appropriate security practices to comply with organization information security program, Develops and presents to management on an annual basis a report on security-related issues and compliance for the organization in the past 12 months.

Requirements

Experience working with legal counsel and management.
Experience working with key departments and committees.
Experience in developing and implementing privacy and confidentiality consent, authorization forms, and information notices.
Experience in establishing and administering a process for handling complaints regarding privacy policies and procedures.
Experience in fostering information privacy awareness.
Experience in coordinating privacy safeguards with security officers.
Experience serving as a resource to regulatory and accrediting bodies for privacy and security matters.
Experience supporting audits concerning privacy laws or regulations.
Experience in developing and presenting annual reports on privacy-related issues and compliance.
Experience in developing security training programs.
Experience in collaborating with a Privacy Officer to develop and implement security policies, procedures, and guidelines.
Experience in researching and recommending new security measures.
Experience in monitoring and testing security practices.
Experience in ensuring security policies and procedures, baselines, risk assessments, risk management, administration, network security, computing asset security, physical security, disaster recovery plans, and third-party service provider security due diligence are in place.
Experience in maintaining documentation regarding user access levels and reviewing these levels.
Experience in investigating, responding to, and remediating security incidents.
Experience in coordinating with a Privacy Officer as outlined in an Incident Response Plan.
Experience in overseeing third parties performing technical system maintenance.
Experience in ensuring third parties comply with appropriate security practices.
Experience in developing and presenting annual reports on security-related issues and compliance.

Responsibilities

Ensure the organization establishes, maintains, and provides appropriate privacy and confidentiality consent, authorization forms, and information notices.
Establish and administer a process for receiving, documenting, tracking, investigating, and acting on complaints concerning privacy policies and procedures.
Initiate, facilitate, and promote activities to foster information privacy awareness.
Coordinate privacy safeguards with the security officer for consistency in development, documentation, and training.
Serve as the organization’s resource to regulatory and accrediting bodies for privacy and security matters.
Support audits concerning state or federal privacy laws or regulations.
Develop and present an annual report on privacy-related issues and compliance.
Develop a security training program that supports privacy and information security programs.
Collaborate with the Privacy Officer to develop and implement security policies, procedures, and guidelines.
Research and recommend new security measures for implementation.
Monitor and test security practices for effectiveness.
Ensure security policies and procedures, baselines, risk assessments, risk management, administration, network security, computing asset security, physical security, disaster recovery plans, and third-party service provider security due diligence are in place.
Maintain documentation regarding user access levels and periodically review these levels.
Investigate, respond to, and remediate security incidents in coordination with legal counsel and outside vendors.
Coordinate with the Privacy Officer as outlined in the Incident Response Plan.
Oversee third parties performing technical system maintenance and ensure compliance with security practices.
Develop and present an annual report on security-related issues and compliance.