The posting
Are you interested in joining a team of experienced healthcare experts and have the ability to shape and transform the healthcare delivery system? At our family of companies, everything we do is to help improve the lives of the nearly 12 million Medicare beneficiaries we serve and 700,000 health care providers who care for them. It is our goal to help create a better health experience for all consumers. Join our winning culture and help transform Medicare for the millions of people who rely on its services.
Benefits info: * Medical, dental, vision, life and supplemental insurance plans effective the first day of the month following date of hire * Short- and long-term disability benefits * 401(k) plan with company match and immediate vesting * Free telehealth benefits * Free gym memberships * Employee Incentive Plan * Employee Assistance Program * Rewards and Recognition Programs * Paid Time Off and Paid Sick Leave
SUMMARY STATEMENT The Senior IT Security Risk Management Analyst is responsible for translating industry, government and business compliance requirements (Defense Information Systems Agency (DISA), National Institute of Standards and Technology (NIST), Health Information Portability and Accountability Act (HIPAA), Federal Information Security Act ( FISMA), Centers of Medicare and Medicaid (CMS), Cybersecurity Framework (CSF), Health and Human Services (HHS and National Archives Records Administration (NARA)), into IT Security and Risk Management frameworks, policies, standards and best practices. The incumbent leads efforts, coordinates and oversees the remediation of non-compliant areas across all the company's lines of business and IT departments including HR, Risk Management, Internal Audit, Legal, Operations, IT, Security and Privacy teams.
ESSENTIAL DUTIES & RESPONSIBILITIES To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. This list of essential job functions is not exhaustive and may be supplemented as necessary.
Primary Duties (80%) * Monitor third party/vendor security posture and information security risk. * Perform vendor security assessment activities including evaluation of vendor controls and practices, process enhancements, including onsite assessments as applicable. * Perform information security risk assessments on identified IT issues raised by IT and business partners, as needed. * Communicate and track remediation plans with vendors, business, and IT partners and where applicable, recommend mitigating/compensating controls * Work to ensure that security controls are managed and maintained by business and IT partners in line with Information Security company policies, standards, federal and state security, and data privacy laws * Develop and maintain information security procedures. * Track Plan of Action and Milestone (POAM) remediation plans with business and IT partners * Participate in IT projects to identify technical and operational information security controls to ensure that security issues are addressed throughout the project life cycle, as needed. * Maintain security risk metrics to promote transparency across the organization. * Maintain Information Security Risk Management and Compliance data repositories * Participate in DISA STIG configuration management compliance reviews
Relationships and Collaboration (20%) * Interact and manage relationships with IT business partners, with CMS, data centers, internal customers, and other business partners to meet contractual obligations for compliance deliverables. * Provide training and technical guidance to less senior staff, where appropriate, and serves as point-of-contact for problem resolution. * Share information and perform necessary follow-up to ensure stakeholders are well informed.
Performs other duties as the supervisor may, from time to time, deem necessary.
REQUIRED QUALIFICATIONS * High School Diploma or GED * 5 years' related work experience. This includes experience coordinating efforts between IT and external audit firms to assist in scheduling, resource planning, and remediation efforts and experience using GRC tools and technologies in support of the assessment/audit process (RSA Archer, Service Now, Logic Manager, Navex, etc.) * Understanding and knowledge of current control and risk management concepts and industry trends in information risk management, including privacy laws * Strong understanding of information security risk management and controls frameworks (i.e., International Organization for Standardization (ISO) 2700; Federal Risk and Authorization Management Program (FedRAMP), Sarbanes Oxley (SOX), NIST, CSF, DISA, Center for Internet Security (CIS) Benchmarks) * Knowledgeable in compliance requirements such as HIPPAA, NIST, HHS, NARA * Proficient in MS Office applications: Microsoft Project, Microsoft VISIO * Strong critical thinking skills to identify issues and problems, generate solutions and choose appropriate solutions that are consistent with business objectives and strategy * Proven ability to work under stress in emergencies with flexibility to handle multiple high-pressure situations * Ability to manage individual deadlines and goals and to take ownership of responsibilities * Ability to learn from mistakes and apply root cause analysis to improve performance * Ability to handle multiple competing priorities in a fast-paced environment * Ability to deal effectively with internal and external regulatory agencies/teams * Strong team-oriented interpersonal skills to work with technical and non-technical business owners to develop control solutions * Demonstrated initiative and effective independent decision-making skills.
CERTIFICATIONS, LICENSES, REGISTRATIONS * Possesses or obtains within 1 year of position placement: Certified Information Systems Auditor (CISA), Certified in Risk and Information System Controls (CRISC), Certified in Governance of Enterprise IT (CGEIT) * Possesses or obtains within 2 years of position placement: Certified Information System Security Professional (CISSP) Cybersecurity Practitioner (CSX-P)
PREFERRED QUALIFICATIONS * 5 years of experience in IT, Information Security, Cyber Risk Management, Compliance, or equivalent combination of transferable experience and education * Knowledge of CMS, HHS, CSF, and CSIAC is strongly preferred
The Federal Government and the Centers for Medicare & Medicaid Services (CMS) may require applicants to have lived in the United States for a minimum of three (3) years out of the last five (5) years to be employed with the Company. These years of residence do not have to be consecutive.
Background Investigation: If you are selected for this position, you must undergo a pre-employment Background Investigation, Drug Screen, and Identity Proofing documentation must be cleared prior to hire. Most positions are subject to additional Identity Proofing, Fingerprinting and additional Background Investigation screening conducted by the Federal Government to be granted Enterprise User Administration (EUA) system logical access after you begin your employment. Your continued employment is contingent upon the outcome of the complete additional screening criteria required for the position which must find that you meet the applicable government customer's requirements (e.g., suitable for access to CMS information and information systems), as well as any additional investigation which may be required throughout your employment. If you are found not suitable, your employment may be subject to corrective action, up to and including immediate termination of employment.
Identity Documentation: You must have access to a current and unrestricted REAL ID, U.S. Passport, U.S. Passport Card, Foreign Passport, or U.S. Permanent Residency Documents. Note: Employment Authorization Cards (EAD) are not a substitute for Visas or U.S. Permanent Resident Cards.
"We are an Equal Opportunity/Protected Veteran/Disabled Employer."
This opportunity is open to remote work in the following approved states: AL, AR, FL, GA, ID, IN, IO, KS, LA, MS, NE, NC, ND, OH, PA, SC, TN, TX, UT, WV, WI, WY. Specific counties and cities within these states may require further approval. In FL and PA in-office and hybrid work may also be available.
