Senior Information Security Analyst (Governance, Risk & Compliance)

Senior Information Security Analyst (Governance, Risk & Compliance)

W2 Role || Remote

### Role Overview

Track and coordinate the work behind the HIPAA Security Risk Analysis and SOC 2 readiness, and support third-party risk, data inventory, and broader compliance programs. Identify and document gaps, then work with the business to drive remediation to closure.

### Responsibilities

- *HIPAA Security Risk Analysis:* Support the annual SRA alongside an external assessor.

  - Confirm scope covers every system that handles ePHI.

  - Coordinate evidence and subject matter expert interviews.

  - Track findings, corrective actions, and exceptions through to closure.

- *SOC 2:* Support readiness and audits through Type 1, Type 2, and ongoing annual cycles.

  - Gap assessments against the Trust Services Criteria.

  - Auditor requests and evidence collection.

  - Control narratives and exception tracking.

  - Monitoring controls between audits.

- *Remediation tracking:* Own the record for each gap (owner, due date, status, evidence), run check-ins with the teams doing the work, and report progress to leadership.

- *Control mapping:* Map controls across HIPAA, SOC 2, and NIST CSF 2.0 so evidence can be reused across frameworks, laying the groundwork for HITRUST.

- *Secondary focus:*

  - Coordinate data, technology, and AI inventories, including where PHI lives, who owns it, and how it's classified.

  - Support third-party risk management:

    - Classify vendors by risk tier.

    - Review SOC reports and security questionnaires.

    - Research vendor risk signals.

    - Coordinate BAAs, NDAs, and MSAs with Legal.

    - Keep vendor onboarding, offboarding, and risk records audit-ready.

  - Maintain the security risk register and risk acceptances, and act as liaison to the enterprise risk management program.

  - Produce regular security metrics and status reporting, and coordinate evidence for periodic user access reviews.

  - Help maintain security policies and procedures, handle first-pass intake for security reviews and RFP security requirements, and support customer security questionnaires.

  - Keep records of approved AI tools and use cases current.

### Qualifications

- 4+ years in security compliance, GRC, risk management, or audit, ideally in healthcare or another highly regulated industry.

- Direct experience supporting SOC 2 audits and HIPAA risk analyses with external auditors or assessors.

- Working knowledge of the HIPAA Security Rule and how PHI moves through cloud and SaaS environments.

- Hands-on experience with at least one GRC or compliance automation platform.

- Strong project coordination skills across multiple teams.

- Day-to-day proficiency using AI tools to streamline compliance work.

- Strong written and verbal communication skills.

*Extra Credit:*

- Familiarity with NIST AI RMF, OWASP SAMM, or HITRUST.

- Vendor security review or third-party risk experience.

- Experience on a small, high-performing team.

- Interest in growing toward security engineering or governance leadership.

- CISA, CRISC, or CISSP (not required).

---