Sr. Security Analyst - IT Security Governance, Risk, Compliance

Medica • Minnetonka, MN

6h • Hybrid

About The Position

Medica is seeking an experienced Sr. Security Analyst. This role is ideal for a detail oriented, highly technical analyst with a depth of experience in IT security, risk, and compliance. This individual is someone who thrives in a mission-driven, healthcare-focused organization and is passionate about ensuring efficiency, scalability, financial integrity and compliance. Key Responsibilities: We're a team that owns our work with accountability, makes data-driven decisions, embraces continuous learning, and celebrates collaboration — because success is a team sport. It's our mission to be there in the moments that matter most for our members and employees. Join us in creating a community of connected care, where coordinated, quality service is the norm and every member feels valued. The Sr. Security Analyst serves as a member of the Security Governance, Risk, and Compliance team to maintain the confidentiality, integrity and availability of sensitive company information. Responsibilities include subject areas such as: HIPAA, HITRUST SOC2, PCI, risk management, third party risk management and annual awareness training. This role is expected to design and develop programs to improve security standards, processes, procedures and solutions. The Sr. Security Analyst is accountable for assisting in designing, building, testing and implementing security systems and solutions within Medica. Key Accountabilities: Third Party Risk Assessment : assess third party security programs, develop monthly reporting, enhance existing processes Audit and Compliance Leadership : lead coordination of HITRUST, SOC2, SOC1 audits, lead responses to customer audit requests Policy Oversite : facilitate updates of security policies and standards, ensure adherence with HIPAA and HITRUST Awareness Training: facilitate annual security awareness training including assisting with content creation and review, execute updates to end user training

Requirements

• Bachelor's degree or equivalent experience in related field
• 5 years of related work experience beyond the degree
• Prior experience managing external auditors such as PWC or Baker Tilly
• IT security compliance experience with working knowledge of common IT security acronyms

Nice To Haves

• Experience with Third Party Assessments
• Prior experience with a GRC tool such as Archer, LogicGate, Inovaare
• Demonstrated experience working with auditors, vendors, and third party partners
• Experience with security policy development and review

Responsibilities

• assess third party security programs
• develop monthly reporting
• enhance existing processes
• lead coordination of HITRUST, SOC2, SOC1 audits
• lead responses to customer audit requests
• facilitate updates of security policies and standards
• ensure adherence with HIPAA and HITRUST
• facilitate annual security awareness training including assisting with content creation and review
• execute updates to end user training

Benefits

• competitive medical, dental, vision, PTO, Holidays, paid volunteer time off, 401K contributions, caregiver services and many other benefits to support our employees

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level