Note: The job is a remote job and is open to candidates in USA. Blue Cross Blue Shield of Massachusetts is a healthcare organization seeking a Senior Information Risk Analyst to strengthen its Information Risk Management program. The role assesses third-party, application, system, compliance, and technology risks; develops mitigation strategies; advises business stakeholders; and communicates risk insights through executive reporting.
Responsibilities
- Perform vendor risk assessments to identify, evaluate and communicate risks to ensure they are properly understood and managed in alignment with organizational risk appetite, as well as applicable legal, regulatory, contractual and organizational requirements throughout the lifecycle of the relationship with the vendor
- Function as a technology risk subject matter expert; possess a strong technical understanding of infrastructure resiliency, secure data transmission protocols, network architecture, and modern threat vectors
- Execute thorough and timely technology risk assessments, including compliance risk, AI risk, application risk, and other analyses, across applications, initiatives, and business processes
- Evaluate contractual protection documentation to ensure vendor agreements mitigate compliance, regulatory, and data risk, mandate appropriate technical and administrative safeguards that protect BCBSMA data within established risk tolerances
- Partner with Legal and Procurement teams to guide negotiations on contract language and mitigation strategies, bringing third-party risk to acceptable levels
- Translate complex HIPAA regulatory requirements and risk mitigations into plain language and guide business units in the implementation of appropriate data safeguarding strategies, ensuring compliance is achieved through practical, risk-based solutions
- Distill complex risk data into high-impact executive dashboards and advanced visual reports for senior leadership with a clear, quantitative understanding of the risk landscape
- Serve as a trusted risk advisor and consultant to business units, partnering with them during the development and coordination of business processes and systems to proactively embed risk management strategies
- Actively engage with business units to gain foresight into upcoming initiatives, ensuring technology risks are proactively managed and embedded from the planning phase
- Contribute expert-level guidance to cross-functional teams in the development of risk, compliance, and information protection policies, standards, and procedures
- Drive the regular review and enhancement of governance documents to ensure they remain practical, relevant, and aligned with our evolving business needs
- Lead targeted internal initiatives and process improvements as directed by leadership to help optimize the team's advisory capabilities and overall risk delivery framework
Skills
- In addition to third-party risk management or a cybersecurity generalist, expertise in one or more of the following: risk management, regulatory compliance, application risk analysis, data analytics, and visualizations
- Solutions-oriented business partner, leveraging a deep understanding of technical defense concepts, vulnerability landscapes, and system safeguard principles
- Strong personal drive, organization and execution skills, and ability to self-manage to a defined outcome, including project decomposition, task identification, leadership alignment, regular status points, and successful on-time completion
- Collaborator who develops and champions practical risk mitigation strategies rather than rigid technical blockers
- Ability to analyze and translate complex technical findings into clear, actionable business contexts, working collaboratively with stakeholders to mitigate risk and enable risk informed executive decisions
- Experience assisting in the development and tracking of Key Risk Indicators (KRIs) and performance metrics to continuously monitor the health of the third-party ecosystem and the broader technology risk program
- Strong interpersonal skills to cultivate relationships and foster cross-team collaboration across the enterprise
- Ability to serve as a mentor to team members, providing peer guidance, operational support, and coaching on technology risk management strategies and assessment processes
- BA or BS degree in Risk Management, Technology, Business Administration, Information Security, a related field, or equivalent practical experience
- 8+ years of experience in third-party risk management, technology, IT, or risk management functions
- 5+ years of dedicated experience executing risk assessments, vendor evaluations, or risk management programs within an information protection framework
- Demonstrated experience navigating healthcare regulatory and compliance frameworks, specifically HIPAA and HITRUST
- Hands-on experience utilizing enterprise GRC platforms and Third-Party Risk Management tools (e.g., Whistic, RiskRecon, ServiceNow, or similar)
- High school degree or equivalent required unless otherwise noted above
- CRISC, CTPRP (Certified Third-Party Risk Professional), or C3PRMP strongly preferred
- Relevant audit, general GRC, or high-level protection certifications are a plus (e.g., CISSP, CISA, GRCP, CGRC, CISM)
Benefits
- This job is also eligible for variable pay.
- Paid time off
- Medical/dental/vision insurance
- 401(k)
- A suite of well-being benefits to eligible employees
- As an employer, we are committed to investing in your development and providing the necessary resources to enable your success.
- Opportunities for employees to forge their unique career path
- Work/life balance support
Company Overview
Company H1B Sponsorship