Principal Risk Analyst

Mayo Clinic • Rochester, MN

2d • $116,043 - $168,293

About The Position

The Privacy Third Party Risk Management Principal Risk Analyst leads and supports complex risk business operations, special projects, compliance and privacy initiatives, mitigation development, and stakeholder education. The position provides day-to-day guidance and project support, participates in multidisciplinary workgroups and projects, and partners with Legal, Supply Chain, the Office of Information Security, Third-Party Risk Management and its risk domains, and business stakeholders. It helps design policies, procedures, and operational processes that support Mayo Clinic’s risk tolerance.

Responsibilities may include third-party privacy risk assessments, Data Protection Impact Assessments, review of de-identified data sets, development of SBARs and executive summaries, peer review of work-unit documentation, support for AI/LLM and Consumer Data Protection Agile Leadership Team workgroups, and communicating actionable risk guidance to leaders and business partners. The analyst also leads risk business operations, special projects, investigations, legal litigation, mitigation development, non-employee access, and end-user awareness and education. The role represents the RD on project teams, committees, strike teams, and workgroups and may require travel to other Mayo Clinic sites or training conferences.

The position requires extensive experience in regulatory compliance and investigations, including subject matter expertise in relevant compliance laws and regulations, the ability to apply the Seven Elements of an Effective Compliance Program, and experience carrying out audits, assessments, and investigations. The analyst uses relevant compliance tools, follows legal holds, and applies evidence preservation and chain-of-custody protocols. Depending on the role, this may include computer forensic evidence handling, data preservation, acquisition of fixed or mobile computing and storage devices, and technical forensic investigations.

Mayo Clinic describes competitive compensation and comprehensive benefits, including medical plan options, dental coverage or reimbursement, vision coverage, HSA and FSA options for eligible expenses, and a competitive retirement package. The role is not eligible for visa sponsorship or transfer, and Mayo Clinic does not participate in the F-1 STEM OPT extension program.

Requirements

• Bachelor’s degree and 7 years of experience in business analysis, compliance, privacy, insider threat, information security, human resources, risk management, information science, business administration, law enforcement, or health- or science-related fields; alternatively, a master’s degree and 5 years of experience in these fields.
• Extensive experience in regulatory compliance and investigations.
• Subject matter expertise in relevant compliance laws and regulations, such as privacy compliance, investigations, revenue cycle compliance, device manufacturing compliance, general compliance, or conflict of interest.
• Understanding of and ability to apply the Seven Elements of an Effective Compliance Program.
• Ability to carry out audits, assessments, and investigations.
• Ability to use relevant compliance tools, including GRC software, monitoring tools, and issue management software.
• Ability to follow and apply legal holds and properly preserve evidence and maintain chain of custody.
• Technical and nontechnical verbal and written communication skills, analytical aptitude, and project management skills.
• High integrity and ability to use discretion and maintain confidential information.
• Ability to obtain government security clearances on behalf of the organization.
• Some travel may be required to other Mayo Clinic sites and/or training conferences.

Nice To Haves

• Master’s degree in Healthcare Administration, Business Administration, or Science.
• Certified Fraud Examiner (CFE), Certification in Healthcare Compliance (CHC), or Healthcare Privacy Compliance (CHPC).
• Juris Doctor (JD) or master’s degree.
• Certification as CHC, CHPC, CCEP, CISSP, CISM, CITPM, or a relevant equivalent certification, or willingness to obtain certification within two years of hire.
• Professional leadership skills and ability to maintain the highest level of confidentiality.
• Advanced analytical and problem-solving skills.
• Investigation and audit experience.
• Ability to work with limited management involvement and minimal supervision.
• Effective training and presentation skills.
• Knowledge of operational risk best practices, effectiveness evaluations, and resources.
• Ability to set priorities, respond to changing demands, follow through, meet regulatory deadlines, anticipate requirements, and build relationships.
• Ability to communicate effectively with diverse groups, including attorneys, physicians, patients, allied health staff, researchers, and vendors.
• Advanced Microsoft Office skills, including Excel, Word, Visio, and PowerPoint.
• Specialized skills for some roles, such as forensic accounting, forensic tools, insider threat, or data loss prevention.
• Depending on the role, advanced knowledge of data preservation, acquisition of fixed or mobile computing and storage devices, and technical forensic investigations.

Responsibilities

• Support and develop RD initiatives and design enterprise business operations, including operational growth and development.
• Lead multidisciplinary workgroups, projects, committees, strike teams, and other project teams.
• Develop policies, procedures, and operational processes that support the organization’s risk tolerance.
• Provide day-to-day operational guidance and project management support to the RD unit.
• Lead risk business operations, special projects, investigations, legal litigation, mitigation development, non-employee access, and end-user awareness and education.
• Conduct or support third-party privacy risk assessments and Data Protection Impact Assessments, and review de-identified data sets.
• Gather and organize information from cross-functional investigative teams.
• Work directly with Legal and Human Resources on high-risk internal and external investigations.
• Work with Legal and External Counsel on policy, regulatory, and litigation matters using eDiscovery protocols.
• Prepare documentation supporting findings, including legal reports, SBARs, and executive summaries.
• Peer review work-unit documentation.
• Develop and present risk training geared toward Mayo Clinic leadership.
• Support AI/LLM and Consumer Data Protection Agile Leadership Team workgroups.
• Communicate actionable risk guidance to leadership and business partners.
• Carry out audits, assessments, and investigations and use relevant compliance tools.
• Follow legal holds and apply evidence preservation and chain-of-custody protocols; depending on the role, handle computer forensic evidence and conduct related technical forensic work.
• Maintain confidentiality and exercise discretion when handling confidential information.
• Travel to other Mayo Clinic sites and/or training conferences as needed.
• Perform other functions and projects as assigned.

Benefits

• Medical plan options.
• Dental coverage through Delta Dental or a reimbursement account for flexible coverage.
• Affordable vision plan with a national network.
• HSA and FSA options for eligible expenses.
• Competitive retirement package.
• Competitive compensation and comprehensive benefit plans.
• Continuing education and advancement opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal