Senior Security Risk & Compliance Analyst
About The Position
The Senior Security Risk & Compliance Analyst oversees risk, audit, legal, and compliance efforts related to information systems and security. The role prepares for audits and security assessments, manages follow-up remediation, and ensures the Security Program addresses internal and external expectations. The analyst contributes to security governance, risk management, compliance, vulnerability management, and third-party risk programs, while working with security, engineering, legal, internal audit, and business stakeholders. The position may require work in a specified time zone or schedule and on-call availability, including evenings, weekends, and holidays, to address operational needs. Abarca offers a flexible hybrid work model requiring certain on-site workdays for the Puerto Rico location only.
Requirements
- Bachelor’s or master’s degree in Information Technology, Computer Science, or a related field; equivalent relevant work experience may be considered in lieu of a degree.
- At least 6 years of experience in Information Security and Healthcare Compliance.
- Experience with internal controls, security policies and procedures, action planning, and execution.
- Experience selecting, implementing, and maintaining security and compliance tools such as SIEM, vulnerability scanning, or identity management solutions.
- Experience with qualitative and quantitative risk management approaches and processes, including implementation experience.
- Experience applying security practices and controls to address risks using frameworks such as NIST, COBIT, and ISO.
- Knowledge of IT compliance and security principles.
- Experience with compliance and local and federal regulations pertaining to the healthcare industry.
- Excellent oral and written communication skills.
Nice To Haves
- One or more certifications such as CISSP, CRISC, CISA, CERP, FAIR/Open FAIR, or CGEIT.
- Experience in healthcare, pharmacy, or pharmacy benefit management, including Medicare Part D and CMS regulations.
- Experience with GRC products such as RSA-Archer, RisKonnect, MetricStream, or ServiceNow GRC.
- Experience leading regulatory compliance and understanding of IT service management frameworks such as ITIL or ISO 20000.
Responsibilities
- Oversee the creation and review of security policies and procedures, incorporating corporate risk, audit, legal, and compliance requirements into the Information Security Program.
- Contribute to implementing and continuously improving security GRC processes; support, configure, test, implement, and maintain those processes in the applicable GRC product.
- Promote adoption of GRC processes, track remediation and relevant metrics, and communicate status and progress.
- Collaborate with security compliance team members to design, implement, and manage regulatory and compliance program requirements in the GRC product.
- Contribute to the strategy and execution of the security governance and risk management program, and cultivate relationships with security, engineering, legal, internal audit, and business stakeholders.
- Lead information security risk assessments and execute internal audits to verify IT controls and identify gaps before formal audits.
- Lead vulnerability assessment efforts and establish baseline monitoring thresholds; support patch and vulnerability management, including periodic scans and patch package creation for deployment by the Infrastructure Team.
- Lead the third-party and supply-chain risk management program, ensuring third parties maintain at least the same level of security and controls, and manage responses to third-party security questionnaires.
- Provide security reporting and KPIs on infrastructure and operations security; aggregate operational data into organizational risk information.
- Evaluate security alerts and incidents and develop and implement plans to reduce organizational risk.
- Support and serve as the Security liaison for the company’s SOC efforts.
- Define, implement, maintain, and enforce corporate security and compliance policies; audit access rights for policy compliance.
- Develop security and compliance requirements for organizational initiatives and research standards to keep policies and procedures current.
- Assist with execution and enforcement of the IT Change Management process.
- Participate in and serve as liaison for the Compliance, Security, and Risk Management (CSRM) Committee.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
