Security Analyst

Indiana Hemophilia & Thrombosis Center•Indianapolis, IN

About The Position

Innovative Hematology, Inc. (IHI) is seeking an experienced Security Analyst to join its Information Technology team. The role combines tactical cybersecurity defense and regulatory compliance oversight to help safeguard electronic protected health information (e-PHI) and hybrid cloud systems. The Security Analyst administers the enterprise Vulnerability Management Program, serves as the primary technical point of contact for the managed security services provider (MSSP), triages security alerts from multiple sources, manages workforce security awareness training, and coordinates compliance audit evidence across Applications, Data & Analytics, Cloud & DevOps, and IT Operations. The position supports vulnerability scanning and remediation governance; security alert monitoring, incident triage, and phishing response; compliance with HIPAA, URAC, NIST CSF, and PCI DSS; access and privilege audits; and workforce training and human-risk metrics. The analyst collaborates with IT Operations on endpoint and server security, Cloud & DevOps on AWS and pipeline security, and Application and Data teams on software risk, database governance, API integrations, and secure data handling. The position is open to residents of Indiana and requires routine presence at IHI’s Center in Indianapolis. The frequency of on-site presence depends on role and department needs. Employees must enable multi-factor authentication using a personal smartphone or smart device to access IHI systems.

Requirements

At least an associate degree in a related field; a bachelor’s degree is preferred.
Three to five years of progressive experience in cybersecurity operations or a related field.
Alternatively, six to eight years of progressive experience in cybersecurity operations.
A valid driver’s license and insured automobile.
Must enable multi-factor authentication using a personal smartphone or smart device to access IHI systems.
Must reside in Indiana.

Nice To Haves

Bachelor’s degree.
Healthcare IT experience.

Responsibilities

Administer the day-to-day enterprise Vulnerability Management Program across internal endpoints, servers, databases, and hybrid cloud infrastructure.
Coordinate routine vulnerability scans, analyze scan data, and validate findings against threat intelligence and operational risk.
Work with IT Operations and Cloud & DevOps Engineering to track, prioritize, and validate remediation of critical and high vulnerabilities within established SLAs.
Document and track risk exceptions and remediation roadblocks in accordance with corporate policy.
Serve as the primary technical point of contact for the external MSSP, managing operational handoffs, alert escalations, and SLA performance.
Monitor, analyze, and triage security alerts across EDR, cloud workloads, identity providers, and email filtering systems.
Investigate and remediate employee phishing submissions and suspected compromised-credential alerts, escalating confirmed incidents under the Incident Response Plan.
Evaluate technical, physical, and administrative safeguards against HIPAA Security Rule, URAC, NIST CSF 2.0, and PCI DSS v4.0 requirements.
Coordinate and gather technical compliance artifacts, audit evidence, and system configuration logs for external audits, annual HIPAA risk assessments, and accreditation renewals.
Conduct routine internal audits of access control lists, privileged user activities, and third-party vendor access for least-privilege and minimum-necessary adherence.
Build, schedule, and administer monthly workforce security awareness training and unannounced simulated phishing campaigns using the enterprise LMS.
Track training completion, phish-prone percentages, and compliance metrics, and collaborate with HR and Compliance to address chronic training delinquencies and phishing failures under corporate policy.
Partner with IT Operations on endpoint hardening, Windows Server security baselines, and Active Directory hygiene.
Collaborate with Cloud & DevOps on AWS security groups, IAM least privilege, container and pipeline security, and AWS network infrastructure.
Work with Application and Data teams to review third-party software risks, database access governance, API integrations, and secure data handling baselines.