Principal Risk Analyst

Mayo Clinic • Rochester, MN

2d • $116,043 - $168,293

About The Position

The Privacy Third Party Risk Management Principal Risk Analyst leads and supports complex risk business operations, special projects, compliance and privacy initiatives, mitigation development, and stakeholder education. The role provides day-to-day guidance and project support, participates in multidisciplinary workgroups and projects, and partners with Legal, Supply Chain, the Office of Information Security, Third-Party Risk Management (TPRM), TPRM risk domains, and business stakeholders. It helps design policies, procedures, and operational processes that support Mayo Clinic’s risk tolerance.

Work may include third-party privacy risk assessments, Data Protection Impact Assessments, review of de-identified data sets, preparation of SBARs and executive summaries, peer review of work-unit documentation, support for AI/LLM and Consumer Data Protection Agile Leadership Team workgroups, and communication of actionable risk guidance to leadership and business partners. The analyst leads investigations, legal litigation support, mitigation development, non-employee access, and end-user awareness and education. The position also supports enterprise business operations and operational growth, leads multidisciplinary projects and workgroups, gathers and organizes information from cross-functional investigative teams, and works with Legal, Human Resources, and external counsel on investigations, policy, regulatory, and litigation matters, including use of eDiscovery protocols. The analyst documents findings, develops and presents risk training for Mayo Clinic leadership, and performs other assigned functions and projects.

The role requires extensive experience in regulatory compliance and investigations, including applicable compliance laws and regulations, the Seven Elements of an Effective Compliance Program, audits and assessments, compliance tools such as GRC and issue-management software, and legal holds and evidence-preservation and chain-of-custody protocols. Some positions may involve computer-forensic evidence handling and technical forensic investigations. Some travel to Mayo Clinic sites or training conferences may be required. The position is not eligible for visa sponsorship or transfer and Mayo Clinic does not participate in the F-1 STEM OPT extension program.

Requirements

• Bachelor’s degree and 7 years of experience in business analysis, compliance, privacy, insider threat, information security, human resources, risk management, information science, business administration, law enforcement, or health- or science-related fields; or a master’s degree and 5 years of experience in those fields.
• Extensive experience in regulatory compliance and investigations.
• Deep subject-matter expertise in relevant compliance laws and regulations, such as privacy, investigations, revenue cycle, device manufacturing, general compliance, and conflict of interest.
• Understanding of and ability to apply the Seven Elements of an Effective Compliance Program.
• Ability to carry out audits, assessments, and investigations.
• Ability to use relevant compliance tools, including GRC software, monitoring tools, and issue-management software.
• Ability to follow and apply legal holds and execute evidence-preservation and chain-of-custody protocols.
• Technical and nontechnical verbal and written communication skills, analytical aptitude, and project-management skills.
• High integrity, discretion, and ability to maintain confidential information.
• Ability to obtain government security clearances on behalf of the organization.
• Some roles require specialized skills such as forensic accounting, forensic tools, insider threat, or data loss prevention.

Nice To Haves

• Master’s degree in Healthcare Administration, Business Administration, or Science.
• Certified Fraud Examiner (CFE), Certification in Healthcare Compliance (CHC), or Healthcare Privacy Compliance (CHPC).
• Juris Doctor (JD) or master’s degree.
• Certification as CHC, CHPC, CCEP, CISSP, CISM, CITPM, or a relevant equivalent, or willingness to obtain certification within two years of hire.
• Professional leadership skills and ability to work with limited management involvement or minimal supervision.
• Advanced analytical and problem-solving skills; investigation and audit experience.
• Effective training and presentation skills.
• Knowledge of operational risk best practices, effectiveness evaluations, and resources.
• Ability to set priorities, respond to changing demands, meet regulatory deadlines, anticipate requirements, follow through, and build relationships.
• Ability to communicate effectively with attorneys, physicians, patients, allied health staff, researchers, and vendors.
• Advanced Microsoft Office skills, including Excel, Word, Visio, and PowerPoint.

Responsibilities

• Support and develop Risk Department initiatives.
• Design enterprise business operations, including operational growth and development.
• Lead multidisciplinary workgroups, projects, committees, and strike teams.
• Develop policies, procedures, and operational processes that support the organization’s risk tolerance.
• Provide day-to-day operational guidance and project management support to the Risk Department unit.
• Conduct or support third-party privacy risk assessments and Data Protection Impact Assessments.
• Review de-identified data sets and support AI/LLM and Consumer Data Protection Agile Leadership Team workgroups.
• Lead or support investigations, legal litigation matters, and mitigation development.
• Gather and organize information from cross-functional investigative teams.
• Work directly with Legal and Human Resources on high-risk internal and external investigations.
• Work with Legal and external counsel on policy, regulatory, and litigation matters, using eDiscovery protocols.
• Complete documentation supporting findings, including legal reports, SBARs, and executive summaries.
• Conduct peer review of work-unit documentation.
• Develop and present risk training for Mayo Clinic leadership and provide stakeholder education.
• Support non-employee access and end-user awareness and education.
• Communicate actionable risk guidance to leadership and business partners.
• Carry out audits, assessments, and investigations; apply legal holds and preserve evidence and chain of custody as applicable.
• Perform other functions and projects as assigned.
• Travel to other Mayo Clinic sites and/or training conferences when required.

Benefits

• Multiple medical plan options.
• Dental coverage through Delta Dental or a reimbursement account for flexible coverage.
• Affordable vision plan with a national network.
• HSA and FSAs for eligible expenses.
• Competitive retirement package.
• Competitive compensation and comprehensive benefit plans.
• Continuing education and advancement opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal