Senior Security Risk & Compliance Analyst

Abarca Health • San Juan, PR

23h • Hybrid

About The Position

The Senior Security Risk and Compliance Analyst oversees risk, audit, legal, and compliance efforts related to Information Systems and Security. The role plans and executes preparation activities for audits and security assessments, and supports remediation afterward. It ensures the Security Program addresses expectations from internal and external audits and assessments.

The analyst contributes to the security governance, risk management, and GRC programs, including configuring and maintaining GRC processes and tools, tracking remediation and metrics, and coordinating with security, engineering, legal, internal audit, and business stakeholders. The position also leads information security risk assessments, internal audits, vulnerability assessment efforts, and third-party and supply-chain risk management. It supports vulnerability and patch management, security reporting, incident and alert risk reduction, SOC efforts, access-rights audits, IT change management, and the Compliance, Security, and Risk Management Committee.

The position requires availability for a specified time zone or schedule to meet business needs. It may require on-call availability during evenings, weekends, and holidays for emergent issues or support, as applicable. A flexible hybrid work model with certain on-site workdays applies to the Puerto Rico location only.

Requirements

• Bachelor’s or master’s degree in Information Technology, Computer Science, or a related field; equivalent relevant work experience may be considered in lieu of a degree.
• At least 6 years of experience in Information Security and Healthcare Compliance.
• Experience in internal controls, security policies and procedures, action planning, and execution.
• Experience selecting, implementing, and maintaining security and compliance tools such as SIEM, vulnerability scanning, or identity management solutions.
• Experience with qualitative and quantitative risk management approaches and processes, including proven implementation experience.
• Experience with security practices and controls for addressing security risks, applying frameworks such as NIST, COBIT, and ISO.
• Experience with the principles behind IT Compliance and Security.
• Experience with compliance and local and federal regulations pertaining to the healthcare industry.
• Excellent oral and written communication skills.
• Availability to work in a specified time zone or schedule to accommodate business needs.
• May require on-call availability, including evenings, weekends, and holidays, for emergent issues or support, as applicable.
• Must be able to access and navigate each department at the organization’s facilities.
• Sedentary work that primarily involves sitting or standing.

Nice To Haves

• One or more certifications such as CISSP, CRISC, CISA, CERP, FAIR/Open FAIR, or CGEIT.
• Experience in the healthcare, pharmacy, or Pharmacy Benefit Management industries, Medicare Part D, and CMS regulations.
• Experience with GRC products such as RSA-Archer, RisKonnect, MetricStream, or ServiceNow GRC.
• Experience leading regulatory compliance and understanding of IT service management frameworks such as ITIL or ISO 20000.

Responsibilities

• Oversee creation and review of security policies and procedures, incorporating corporate risk, audit, legal, and compliance requirements into the Information Security Program.
• Contribute to the implementation and continuous improvement of security GRC processes.
• Support, configure, test, implement, and maintain GRC processes in the applicable GRC product.
• Operationalize and manage awareness and adoption of GRC processes.
• Track remediation and relevant metrics to communicate status, demonstrate progress, and build awareness of GRC processes.
• Collaborate with security compliance team members to design, implement, and manage regulatory and compliance program requirements in the GRC product.
• Contribute to the strategy and execution of the overall security governance and risk management program.
• Cultivate relationships with security, engineering, legal, internal audit, and business stakeholders to strengthen security governance and risk management.
• Lead and manage information security risk assessments and execute internal audits to verify IT controls and identify gaps before formal audits.
• Lead vulnerability assessment efforts and establish baseline monitoring thresholds for the company.
• Support patch and vulnerability management, including periodic vulnerability scans and patch package creation for deployment by the Infrastructure Team.
• Lead and manage the third-party risk management and supply-chain risk management program, ensuring third parties maintain at least the same level of security and controls.
• Lead and manage responses to third-party security questionnaires.
• Provide security reporting and KPIs on Infrastructure/Operations Security components.
• Roll up operational-level data into organizational-level risk information.
• Evaluate security alerts and incidents and develop and implement plans to reduce organizational risk.
• Support and serve as the Security liaison for the company’s SOC efforts.
• Define, implement, maintain, and enforce corporate security and compliance policies.
• Audit access rights to ensure compliance with policy.
• Develop security and compliance requirements for organizational initiatives.
• Research security and compliance standards and keep policies and procedures up to date.
• Assist with execution and enforcement of the IT Change Management process.
• Participate in and serve as liaison for the Compliance, Security, and Risk Management Committee.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior