Network Compliance & Risk Administrator

Independent Health Association•Buffalo, NY

18d•Hybrid

About The Position

The Network Compliance & Risk Administrator is responsible for executing, administering, and monitoring the compliance program related to technical risk and cybersecurity, data governance and integrity, and laws and regulations governing data. The role supports contract and regulatory activities and helps ensure that Reliance Rx’s technical systems, processes, and data handling comply with applicable laws, regulations, and industry standards. Reporting to the Deputy Counsel-Regulatory Compliance Manager and working under that person’s direction, the administrator serves as a liaison among Reliance Rx business units, the parent company Information Risk Office, other departments, vendors, and regulatory bodies. The role researches and analyzes proposed, pending, and effective requirements concerning cybersecurity, artificial intelligence, data governance and integrity, information privacy and security, and interoperability. It also assesses and implements appropriate cybersecurity frameworks and processes to harden and protect the Reliance Rx environment. The position works with the Reliance Rx Leadership Team to keep leaders informed about applicable regulations and support compliance, and collaborates with the pharmacy team and internal audit on relevant requirements. This is a hybrid position requiring onsite attendance at the Williamsville location. Work visa sponsorship will not be provided.

Requirements

Bachelor’s degree, or an additional four years of experience in lieu of a degree.
Four years of experience in compliance, quality assurance, auditing, or data governance/process management within a regulated environment.
Experience with data security, encryption, data masking, DLP technologies, data discovery and classification tools, and data privacy, including cloud access security broker (CASB) solutions.
Experience with cloud and multi-tenant environment frameworks and architecture, including AWS.
Understanding of healthcare privacy program elements relating to regulatory oversight, monitoring requirements, and data security measures, including HITRUST, NIST, ITIL, HIPAA, and HITECH.
Advanced experience with Microsoft Office applications and ability to learn new software applications.
Excellent research skills and independent judgment in determining which regulatory changes should be reflected in collateral and training.
Excellent analytical skills, including the ability to analyze legislation and draft policies and procedures based on regulatory requirements.
Excellent composition and drafting skills, particularly for compliance and regulatory documents and correspondence.
Excellent verbal and written communication and interpersonal skills.
Ability to build and maintain relationships with internal and external stakeholders.
Proficiency in research and preparation of substantive work requiring knowledge of compliance concepts, particularly HIPAA/HITECH.
Initiative, creativity, project management, and organizational abilities.
Demonstrated examples of the Reliance values: Collaborative, Accessible, Results-Oriented, Empowering, and Supportive.

Nice To Haves

Healthcare or pharmacy-related experience.
An industry-recognized certification in information security, information technology, or privacy, such as CISSP, GIAC, CISM, CIPT, or CIPP/US.

Responsibilities

Research state and federal laws and regulations concerning data privacy and handling, including state privacy laws, HIPAA/HITECH, DSCSA, and PCI DSS, and monitor changes.
Research the organization’s compliance obligations regarding HIPAA/HITECH, data privacy and security, cybersecurity practices, cloud environment protection, and artificial intelligence, and provide recommendations to Reliance Rx leadership.
Monitor emerging artificial intelligence laws, regulations, and guidance; assess organizational AI use for regulatory, privacy, security, and governance compliance.
Research and present appropriate cybersecurity certifications to leadership and, when implemented, initiate and maintain the certifications and related requirements.
Support tracking and monitoring of contractual technical risk maintenance and compliance processes.
Coordinate with the parent Information Risk Office and relevant departments during negotiation and review of contracts containing technical compliance, HIPAA/HITECH, and security terms.
Support requests for proposals and contractually required cybersecurity assessments and questionnaires.
Coordinate third-party security risk assessments, including vendor due diligence, cybersecurity questionnaires, and remediation tracking.
Support development, implementation, communication, and ongoing improvement of technical compliance, privacy, cybersecurity, and information security programs with parent company Compliance and Information Risk teams.
Manage technical compliance policies, procedures, standards, and governance processes, including regulatory review, updates, documentation, and organizational communication.
Develop and maintain cybersecurity risk management processes, including security assessments, incident response planning, risk tracking, vulnerability management, and remediation oversight.
Monitor and report technical compliance, cybersecurity, privacy, and security metrics, key risk indicators, regulatory requirements, and program effectiveness.
Coordinate technical compliance training and security awareness activities, including onboarding, annual education, attestations, and assessments.
Oversee identification, investigation, escalation, reporting, and remediation of technical compliance, privacy, and security incidents, including corrective action plans.
Collaborate with business, operational, and technical teams to establish and monitor data governance, data protection, access management, retention, and security controls.
Coordinate cybersecurity testing and monitoring, including vulnerability assessments, penetration testing, phishing simulations, endpoint monitoring, and risk reviews, and ensure timely remediation and leadership reporting.
Serve as the primary liaison between Reliance Rx and parent Compliance and Information Risk functions for technical compliance, privacy, security, audits, investigations, assessments, and regulatory inquiries.
Facilitate compliance committee activities, risk exception reviews, security governance processes, and related reporting.
Serve as the primary contact for associate questions, concerns, and reports about technical compliance, privacy, and security.
Promote awareness of technical compliance, privacy, and cybersecurity requirements through communication, education, and engagement.