IT Risk

Regular Exempt GENERAL DESCRIPTION: The IT Risk & Compliance Analyst is responsible for executing the day-to-day risk management, compliance tracking, and internal auditing frameworks of the organization. This role focuses on verifying that internal controls align with healthcare regulatory standards. Supports the protection of the organization's applications and information systems by promoting compliance with security requirements, identifying and mitigating risks, and assisting in the implementation of security controls that enhance the confidentiality, integrity, and availability of business-critical systems and data. ESSENTIAL FUNCTIONS:
• Reviews enterprise and technology projects to identify applicable information security requirements and risks.
• Validates project and technology compliance with established information security policies, standards, and requirements.
• Performs security risk assessments and documents identified risks, potential impacts, and required remediation actions.
• Recommends appropriate or compensating security controls when standard requirements cannot be fully implemented.
• Issues security approvals or formally documented exceptions based on risk assessments, applicable requirements, and defined approval authorities.
• Evaluates application architectures, system designs, and technology implementations to identify security risks and recommend appropriate controls.
• Identifies, assesses, documents, and communicates application security risks and provide recommendations to reduce exposure and improve security posture.
• Serves as a subject matter expert for development, infrastructure, and business teams by providing recommendations, training, and best practices related to risk management.
• Recommends and implements process improvements that enhance security governance, risk management, and application protection capabilities.
• Actively participates in the new employee induction program to guide new employees on the company’s IT security policies and controls.
• Must comply fully and consistently with all company policies and procedures, with local and federal laws as well as with the regulations applicable to our Industry, to maintain appropriate business and employment practices.
• May carry out other duties and responsibilities as assigned, according to the requirements of education and experience contained in this document. MINIMUM

REQUIREMENTS:
Education and

Experience:
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or related field. At least three years in information security governance, risk, and compliance (GRC), ideally within the healthcare industry. “Proven experience may be replaced by previously established requirements.” Certifications / Licenses: At least one of the following is preferred: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or Computing Technology Industry Association Security+ (CompTIA Security+). Other: N/A Languages: Spanish – Advanced (comprehensive, writing and verbal) English – Intermediate (comprehensive, writing and verbal) “We are an Equal Employment Opportunity Employer and take Affirmative Action to recruit Protected Veterans and Individuals with Disabilities.”