Principal Risk Analyst

Mayo Clinic•Rochester, MN

About The Position

The Privacy Third Party Risk Management Principal Risk Analyst leads and supports complex risk business operations, special projects, compliance and privacy initiatives, mitigation development, and stakeholder education. The role provides day-to-day guidance and project support, participates in multidisciplinary workgroups and projects, and partners with Legal, Supply Chain, the Office of Information Security, Third-Party Risk Management (TPRM), TPRM risk domains, and business stakeholders. The analyst helps design policies, procedures, and operational processes that support Mayo Clinic’s risk tolerance. Responsibilities may include third-party privacy risk assessments, Data Protection Impact Assessments, review of de-identified data sets, preparation of SBARs and executive summaries, peer review of work-unit documentation, support for AI/LLM and Consumer Data Protection Agile Leadership Team (CDPALT) workgroups, and communication of actionable risk guidance to leadership and business partners. The role also leads risk business operations, special projects, investigations, legal litigation support, mitigation development, non-employee access, and end-user awareness and education. The incumbent provides day-to-day operational and project-management guidance to the RD unit and represents RD on project teams, committees, strike teams, and workgroups. The role requires extensive experience in regulatory compliance and investigations, technical and nontechnical communication skills, analytical aptitude, project-management skills, integrity, discretion, and the ability to maintain confidential information. Some travel to other Mayo Clinic sites and/or training conferences may be required. The position is not eligible for visa sponsorship or transfer and is not eligible for the F-1 STEM OPT extension program.

Requirements

Bachelor’s degree and 7 years of experience in business analysis, compliance, privacy, insider threat, information security, human resources, risk management, information science, business administration, law enforcement, or health- or science-related fields; or a master’s degree and 5 years of experience in those fields.
Extensive experience in regulatory compliance and investigations.
Subject matter expertise in relevant compliance laws and regulations, such as privacy compliance, investigations, revenue cycle compliance, device manufacturing compliance, general compliance, and conflict of interest.
Understanding of and ability to apply the Seven Elements of an Effective Compliance Program.
Ability to use relevant compliance tools, including GRC software, monitoring tools, and issue-management software.
Ability to follow and apply legal holds and execute proper evidence preservation and chain-of-custody protocols.
Technical and nontechnical verbal and written communication skills.
Analytical aptitude and project-management skills.
High integrity, discretion, and ability to maintain confidential information.
Ability to obtain government security clearances on behalf of the organization.
Some travel to other Mayo Clinic sites and/or training conferences may be required.

Nice To Haves

Master’s degree in Healthcare Administration, Business Administration, or Science.
Certified Fraud Examiner (CFE), Certification in Healthcare Compliance (CHC), or Healthcare Privacy Compliance (CHPC).
Professional leadership skills and ability to maintain the highest level of confidentiality.
Advanced analytical and problem-solving skills.
Investigation and audit experience.
Ability to work with limited management involvement.
Effective training and presentation skills.
Knowledge of operational risk best practices, effectiveness evaluations, and resources.
Ability to set priorities and respond to changing demands from multiple sources.
Ability to follow through, meet regulatory deadlines, anticipate requirements, and build relationships.
Ability to communicate effectively with diverse groups, including attorneys, physicians, patients, allied health staff, researchers, and vendors.
Ability to collaborate in a team environment with minimal supervision.
Advanced Microsoft Office skills, including Excel, Word, Visio, and PowerPoint.
Specialized skills for certain roles, such as forensic accounting, forensic tools, insider threat, or data loss prevention.
JD or master’s degree.
Certification in CHC, CHPC, CCEP, CISSP, CISM, CITPM, or a relevant equivalent, or willingness to obtain certification within two years of hire.

Responsibilities

Support and develop RD initiatives.
Design enterprise business operations, including operational growth and development.
Lead multidisciplinary workgroups and projects.
Develop policies and procedures that support the organization’s risk tolerance.
Gather and organize information from cross-functional investigative teams.
Work with Legal and Human Resources on high-risk internal and external investigations.
Work with Legal and external counsel on policy, regulatory, and litigation matters using eDiscovery protocols.
Complete documentation supporting findings, including legal reports, SBARs, and executive summaries.
Conduct peer review of work-unit documentation.
Develop and present risk training for Mayo Clinic leadership.
Support third-party privacy risk assessments, Data Protection Impact Assessments, and review of de-identified data sets.
Support AI/LLM and CDPALT workgroups.
Communicate actionable risk guidance to leadership and business partners.
Provide day-to-day operational guidance and project-management support to the RD unit.
Represent RD on project teams, committees, strike teams, and workgroups.
Carry out audits, assessments, and investigations.
Apply legal holds and preserve evidence, including chain-of-custody protocols.
Perform other functions and projects as assigned.