Sr IT Security Risk Mgmt Anlst - GuideWell Source

GuideWell Source • Remote, OH

12h • Remote

About The Position

The Senior IT Security Risk Management Analyst translates industry, government, and business compliance requirements into IT security and risk management frameworks, policies, standards, and best practices. The role leads, coordinates, and oversees remediation of non-compliant areas across company lines of business and IT departments, collaborating with HR, Risk Management, Internal Audit, Legal, Operations, IT, Security, and Privacy teams.

The analyst monitors third-party and vendor security posture, conducts vendor security assessments and risk assessments of IT issues, tracks remediation plans, recommends mitigating or compensating controls, and helps ensure business and IT partners maintain security controls in accordance with company policies and applicable regulations. The position also develops security procedures, participates in IT projects and DISA STIG compliance reviews, maintains risk metrics and compliance repositories, and provides guidance and training to less senior staff. The role collaborates with internal and external stakeholders, including CMS and data centers, to meet compliance deliverables.

Requirements

• High school diploma or GED.
• Five years of related work experience, including coordinating IT and external audit firm efforts for scheduling, resource planning, and remediation, and using GRC tools and technologies in assessment or audit processes (such as RSA Archer, ServiceNow, LogicManager, or Navex).
• Understanding of current control and risk management concepts and industry trends in information risk management, including privacy laws.
• Strong understanding of information security risk management and control frameworks, including ISO 2700, FedRAMP, SOX, NIST, CSF, DISA, and CIS Benchmarks.
• Knowledge of compliance requirements such as HIPAA, NIST, HHS, and NARA.
• Proficiency with Microsoft Office applications, including Microsoft Project and Microsoft Visio.
• Strong critical-thinking skills to identify problems, develop solutions, and select solutions consistent with business objectives and strategy.
• Ability to work under stress during emergencies and flexibly handle multiple high-pressure situations.
• Ability to manage individual deadlines and goals and take ownership of responsibilities.
• Ability to learn from mistakes and apply root-cause analysis to improve performance.
• Ability to manage multiple competing priorities in a fast-paced environment.
• Ability to deal effectively with internal and external regulatory agencies and teams.
• Strong interpersonal and team-oriented skills to work with technical and non-technical business owners to develop control solutions.
• Demonstrated initiative and effective independent decision-making skills.
• Obtain or possess CISA, CRISC, or CGEIT certification within one year of placement.
• Obtain or possess CISSP or CSX-P certification within two years of placement.
• Must have access to a current, unrestricted REAL ID, U.S. Passport, U.S. Passport Card, Foreign Passport, or U.S. permanent residency documents.
• Must complete pre-employment background investigation, drug screening, and identity-proofing documentation; continued employment is contingent on satisfying applicable government customer screening requirements.
• The Federal Government and CMS may require applicants to have lived in the United States for at least three of the last five years; the years need not be consecutive.

Nice To Haves

• Five years of experience in IT, Information Security, Cyber Risk Management, Compliance, or an equivalent combination of transferable experience and education.
• Knowledge of CMS, HHS, CSF, and CSIAC is strongly preferred.

Responsibilities

• Monitor third-party and vendor security posture and information security risk.
• Conduct vendor security assessments, including evaluating controls and practices, enhancing processes, and performing onsite assessments when applicable.
• Conduct information security risk assessments of IT issues raised by IT and business partners as needed.
• Communicate and track remediation plans with vendors, business partners, and IT partners; recommend mitigating or compensating controls where applicable.
• Help ensure business and IT partners manage and maintain security controls in accordance with company policies, standards, federal and state security requirements, and data privacy laws.
• Develop and maintain information security procedures.
• Track Plan of Action and Milestone (POAM) remediation plans with business and IT partners.
• Participate in IT projects as needed to identify technical and operational security controls and address security issues throughout the project life cycle.
• Maintain security risk metrics to promote organizational transparency.
• Maintain Information Security Risk Management and Compliance data repositories.
• Participate in DISA STIG configuration management compliance reviews.
• Manage relationships with IT business partners, CMS, data centers, internal customers, and other business partners to meet contractual compliance deliverables.
• Provide training and technical guidance to less senior staff and serve as a point of contact for problem resolution.
• Share information and follow up to ensure stakeholders are informed.
• Perform other duties as assigned by the supervisor.

Benefits

• Medical, dental, vision, life, and supplemental insurance plans effective the first day of the month following hire.
• Short- and long-term disability benefits.
• 401(k) plan with company match and immediate vesting.
• Free telehealth benefits.
• Free gym memberships.
• Employee Incentive Plan.
• Employee Assistance Program.
• Rewards and Recognition Programs.
• Paid Time Off and Paid Sick Leave.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED