IT Security Analyst, QuadMed

Quad•Sussex, WI

4h•$75,000 - $90,000•Remote

About The Position

QuadMed is seeking an IT Security Analyst to join its IT team. This remote role includes occasional travel. The analyst assists the Director of Information Security and Compliance in developing, coordinating, and supporting QuadMed’s information security, risk management, and compliance programs. The role includes special projects, information security and compliance auditing and monitoring, and identifying opportunities to improve the organization’s risk posture. The analyst reviews organizational and functional activities to evaluate information technology security controls; performs audits and supports projects to improve systems and processes or reduce risk; helps track organizational risks and mitigation efforts; and coordinates third-party audits and assessments. The role also supports vendor security risk assessments, audit remediation and process improvements, monitoring for questionable user activity, documentation and performance reporting, employee security awareness and testing, and reviews of system documentation and security or compliance policies and procedures. Other duties may be assigned in support of departmental initiatives and company goals. QuadMed provides comprehensive benefits for eligible employees, including medical, prescription, dental and vision insurance, 401(k) retirement savings, paid time off, holidays, and additional benefits.

Requirements

Bachelor’s degree from a four-year college or university in business, healthcare, information technology, security, or a related field.
At least one year of experience in a healthcare setting is identified as ideal, particularly in a HIPAA, privacy, security, or audit/compliance-related role.
Knowledge of healthcare laws and regulations, auditing and monitoring principles, risk management, and electronic health record systems.
Knowledge and experience with HIPAA and other privacy-related regulations and their application in a healthcare setting, or comparable experience interpreting complex regulations and communicating them across an organization.
Analytical and problem-solving skills to assess internal controls, policies, and procedures and recommend process improvements.
Excellent attention to detail and strong written and verbal communication skills; ability to make critical decisions based on data analysis.
Collaborative approach and ability to influence others and build professional relationships.
High degree of credibility, independence, integrity, confidentiality, and trustworthiness.
Ability to work independently, exercise judgment, and set priorities.
Ability to research, compile, and analyze regulatory and business information, assess compliance or other business risks, and provide feedback or recommendations.
Ability to work effectively with diverse populations and demonstrated commitment to fostering inclusion.

Nice To Haves

Certifications in healthcare compliance, privacy, security, health information management, risk management assurance, internal auditing, and/or Epic Systems.

Responsibilities

Review organizational and functional activities to evaluate the adequacy and effectiveness of information technology security controls, including IT general controls and related tools.
Perform regular audits and participate in projects to improve systems or processes and reduce organizational risks, including work related to IT general controls, SOC 2, PCI, and HIPAA.
Assist with developing risk and threat matrices and tracking organizational risks and mitigation efforts, including scorecards, security reporting, and vulnerability tracking.
Coordinate and assist with third-party audits and assessments, including HIPAA, risk, disaster recovery, PCI, and SOC 2 assessments.
Assist with security risk assessments for new and current third-party vendors.
Collaborate with other departments on process improvements and remediation activities arising from internal and external audit findings.
Use reporting tools to identify questionable user behavior, such as inappropriate access, irregular usage patterns, and excessive account lockouts.
Prepare and maintain data, records, reports, and other documentation relevant to the role, and assist with reporting business performance in these areas.
Coordinate employee education, awareness, training, and testing activities, including phishing and insider threat testing.
Seek new, automated, or more efficient auditing and monitoring techniques to improve departmental and organizational efficiency and effectiveness.
Help coordinate reviews of system documentation and security- or compliance-related policies and procedures.
Perform other duties as assigned in support of departmental initiatives and company strategic goals.