Senior Information Security Analyst (Governance, Risk & Compliance)
W2 Role || Remote
### Role Overview
Track and coordinate the work behind the HIPAA Security Risk Analysis and SOC 2 readiness, and support third-party risk, data inventory, and broader compliance programs. Identify and document gaps, then work with the business to drive remediation to closure.
### Responsibilities
- *HIPAA Security Risk Analysis:* Support the annual SRA alongside an external assessor.
- Confirm scope covers every system that handles ePHI.
- Coordinate evidence and subject matter expert interviews.
- Track findings, corrective actions, and exceptions through to closure.
- *SOC 2:* Support readiness and audits through Type 1, Type 2, and ongoing annual cycles.
- Gap assessments against the Trust Services Criteria.
- Auditor requests and evidence collection.
- Control narratives and exception tracking.
- Monitoring controls between audits.
- *Remediation tracking:* Own the record for each gap (owner, due date, status, evidence), run check-ins with the teams doing the work, and report progress to leadership.
- *Control mapping:* Map controls across HIPAA, SOC 2, and NIST CSF 2.0 so evidence can be reused across frameworks, laying the groundwork for HITRUST.
- *Secondary focus:*
- Coordinate data, technology, and AI inventories, including where PHI lives, who owns it, and how it's classified.
- Support third-party risk management:
- Classify vendors by risk tier.
- Review SOC reports and security questionnaires.
- Research vendor risk signals.
- Coordinate BAAs, NDAs, and MSAs with Legal.
- Keep vendor onboarding, offboarding, and risk records audit-ready.
- Maintain the security risk register and risk acceptances, and act as liaison to the enterprise risk management program.
- Produce regular security metrics and status reporting, and coordinate evidence for periodic user access reviews.
- Help maintain security policies and procedures, handle first-pass intake for security reviews and RFP security requirements, and support customer security questionnaires.
- Keep records of approved AI tools and use cases current.
### Qualifications
- 4+ years in security compliance, GRC, risk management, or audit, ideally in healthcare or another highly regulated industry.
- Direct experience supporting SOC 2 audits and HIPAA risk analyses with external auditors or assessors.
- Working knowledge of the HIPAA Security Rule and how PHI moves through cloud and SaaS environments.
- Hands-on experience with at least one GRC or compliance automation platform.
- Strong project coordination skills across multiple teams.
- Day-to-day proficiency using AI tools to streamline compliance work.
- Strong written and verbal communication skills.
*Extra Credit:*
- Familiarity with NIST AI RMF, OWASP SAMM, or HITRUST.
- Vendor security review or third-party risk experience.
- Experience on a small, high-performing team.
- Interest in growing toward security engineering or governance leadership.
- CISA, CRISC, or CISSP (not required).
---
