Security Analyst

Innovative Hematology, Inc.•Indianapolis, IN

15h•Hybrid

About The Position

Innovative Hematology, Inc. (IHI) is seeking an experienced Security Analyst to join its Information Technology team. The position combines cybersecurity defense and regulatory compliance oversight to protect electronic Protected Health Information (e-PHI) and hybrid cloud systems. The Security Analyst administers the enterprise Vulnerability Management Program, serves as the primary technical point of contact for the managed security service provider (MSSP), triages security alerts, manages workforce security awareness training, and coordinates audit evidence across Applications, Data & Analytics, Cloud & DevOps, and IT Operations. The role oversees vulnerability scanning and analysis, remediation tracking, and risk-exception documentation. It monitors and investigates alerts from endpoint, cloud, identity, and email systems; responds to phishing reports and suspected compromised credentials; and coordinates escalation of confirmed incidents. The Security Analyst evaluates safeguards against HIPAA, URAC, NIST CSF, and PCI DSS requirements, coordinates audit artifacts and configuration logs, and performs access and privilege audits. The position also administers monthly workforce security training and simulated phishing campaigns, tracks training and phishing metrics, and works with HR and Compliance on chronic delinquencies and failures. The analyst collaborates with IT teams on endpoint and server hardening, AWS security, identity and access controls, container and pipeline security, third-party software risks, database governance, API integrations, and secure data handling. The position is open to residents of Indiana and requires routine presence at IHI’s Center in Indianapolis; the frequency of on-site work depends on role and department needs. Employees must enable multi-factor authentication using a personal smartphone or smart device to access IHI systems. A valid driver’s license and insured automobile are required.

Requirements

Associate’s degree in a related field.
Three to five years of progressive experience in cybersecurity operations or a related field; alternatively, six to eight years of progressive experience in cybersecurity operations.
Valid driver’s license and insured automobile.
Must enable multi-factor authentication using a personal smartphone or smart device to access IHI systems.
Must reside in Indiana; the position requires routine presence at IHI’s Center in Indianapolis.

Nice To Haves

Bachelor’s degree preferred.
Healthcare IT experience strongly preferred.

Responsibilities

Administer the enterprise Vulnerability Management Program across endpoints, servers, databases, and hybrid cloud infrastructure.
Coordinate vulnerability scanning schedules, analyze results, and validate findings against threat intelligence and operational risk.
Partner with IT Operations and Cloud & DevOps Engineering to track, prioritize, and validate remediation of critical and high vulnerabilities within established SLAs.
Document and track risk exceptions and remediation roadblocks in accordance with corporate policy.
Serve as the primary technical point of contact for the external MSSP, managing operational handoffs, alert escalations, and SLA performance.
Monitor, analyze, and triage security alerts across EDR, cloud workloads, identity providers, and email filtering systems.
Review, investigate, and remediate employee phishing reports and suspected compromised credential alerts; escalate confirmed incidents under the Incident Response Plan.
Evaluate technical, physical, and administrative safeguards against HIPAA, URAC, NIST CSF 2.0, and PCI DSS v4.0 requirements.
Coordinate technical compliance artifacts, audit evidence, and system configuration logs for external audits, annual HIPAA risk assessments, and accreditation renewals.
Conduct routine audits of access control lists, privileged user activities, and third-party vendor access for adherence to least privilege and minimum necessary principles.
Build, schedule, and administer monthly workforce security awareness training and unannounced simulated phishing campaigns using the enterprise LMS.
Track training completion, phish-prone percentages, and compliance metrics; collaborate with HR and Compliance to address chronic training delinquencies and phishing failures.
Collaborate with IT Operations on endpoint hardening, Windows Server security baselines, and Active Directory hygiene.
Collaborate with Cloud & DevOps on AWS security groups, IAM least privilege, container and pipeline security, and AWS network infrastructure.
Work with Application and Data teams on third-party software risks, database access governance, API integrations, and secure data-handling baselines.