Are you interested in joining a team of experienced healthcare experts and have
the ability to shape and transform the healthcare delivery system? At our family
of companies, everything we do is to help improve the lives of the nearly 12
million Medicare beneficiaries we serve and 700,000 health care providers who
care for them. It is our goal to help create a better health experience for all
consumers. Join our winning culture and help transform Medicare for the millions
of people who rely on its services.
Benefits info:
Medical, dental, vision, life and supplemental insurance plans effective the
first day of the month following date of hire
Short- and long-term disability benefits
401(k) plan with company match and immediate vesting
Free telehealth benefits
Free gym memberships
Employee Incentive Plan
Employee Assistance Program
Rewards and Recognition Programs
Paid Time Off and Paid Sick Leave
SUMMARY STATEMENT
The Senior IT Security Risk Management Analyst is responsible for translating
industry, government and business compliance requirements (Defense Information
Systems Agency (DISA), National Institute of Standards and Technology (NIST),
Health Information Portability and Accountability Act (HIPAA), Federal
Information Security Act ( FISMA), Centers of Medicare and Medicaid (CMS),
Cybersecurity Framework (CSF), Health and Human Services (HHS and National
Archives Records Administration (NARA)), into IT Security and Risk Management
frameworks, policies, standards and best practices. The incumbent leads efforts,
coordinates and oversees the remediation of non-compliant areas across all the
company's lines of business and IT departments including HR, Risk Management,
Internal Audit, Legal, Operations, IT, Security and Privacy teams.
ESSENTIAL DUTIES & RESPONSIBILITIES
To perform this job successfully, an individual must be able to perform each
essential duty satisfactorily. Reasonable accommodations may be made to enable
individuals with disabilities to perform the essential functions. This list of
essential job functions is not exhaustive and may be supplemented as necessary.
Primary Duties (80%)
Monitor third party/vendor security posture and information security risk.
Perform vendor security assessment activities including evaluation of vendor
controls and practices, process enhancements, including onsite assessments as
applicable.
Perform information security risk assessments on identified IT issues raised
by IT and business partners, as needed.
Communicate and track remediation plans with vendors, business, and IT
partners and where applicable, recommend mitigating/compensating controls
Work to ensure that security controls are managed and maintained by business
and IT partners in line with Information Security company policies, standards,
federal and state security, and data privacy laws
Develop and maintain information security procedures.
Track Plan of Action and Milestone (POAM) remediation plans with business and
IT partners
Participate in IT projects to identify technical and operational information
security controls to ensure that security issues are addressed throughout the
project life cycle, as needed.
Maintain security risk metrics to promote transparency across the
organization.
Maintain Information Security Risk Management and Compliance data repositories
Participate in DISA STIG configuration management compliance reviews
Relationships and Collaboration (20%)
Interact and manage relationships with IT business partners, with CMS, data
centers, internal customers, and other business partners to meet contractual
obligations for compliance deliverables.
Provide training and technical guidance to less senior staff, where
appropriate, and serves as point-of-contact for problem resolution.
Share information and perform necessary follow-up to ensure stakeholders are
well informed.
Performs other duties as the supervisor may, from time to time, deem necessary.
REQUIRED QUALIFICATIONS
High School Diploma or GED
5 years' related work experience. This includes experience coordinating
efforts between IT and external audit firms to assist in scheduling, resource
planning, and remediation efforts and experience using GRC tools and
technologies in support of the assessment/audit process (RSA Archer, Service
Now, Logic Manager, Navex, etc.)
Understanding and knowledge of current control and risk management concepts
and industry trends in information risk management, including privacy laws
Strong understanding of information security risk management and controls
frameworks (i.e., International Organization for Standardization (ISO) 2700;
Federal Risk and Authorization Management Program (FedRAMP), Sarbanes Oxley
(SOX), NIST, CSF, DISA, Center for Internet Security (CIS) Benchmarks)
Knowledgeable in compliance requirements such as HIPPAA, NIST, HHS, NARA
Proficient in MS Office applications: Microsoft Project, Microsoft VISIO
Strong critical thinking skills to identify issues and problems, generate
solutions and choose appropriate solutions that are consistent with business
objectives and strategy
Proven ability to work under stress in emergencies with flexibility to handle
multiple high-pressure situations
Ability to manage individual deadlines and goals and to take ownership of
responsibilities
Ability to learn from mistakes and apply root cause analysis to improve
performance
Ability to handle multiple competing priorities in a fast-paced environment
Ability to deal effectively with internal and external regulatory
agencies/teams
Strong team-oriented interpersonal skills to work with technical and
non-technical business owners to develop control solutions
Demonstrated initiative and effective independent decision-making skills.
CERTIFICATIONS, LICENSES, REGISTRATIONS
Possesses or obtains within 1 year of position placement: Certified
Information Systems Auditor (CISA), Certified in Risk and Information System
Controls (CRISC), Certified in Governance of Enterprise IT (CGEIT)
Possesses or obtains within 2 years of position placement: Certified
Information System Security Professional (CISSP) Cybersecurity Practitioner
(CSX-P)
PREFERRED QUALIFICATIONS
5 years of experience in IT, Information Security, Cyber Risk Management,
Compliance, or equivalent combination of transferable experience and education
Knowledge of CMS, HHS, CSF, and CSIAC is strongly preferred
Qualifications
The Federal Government and the Centers for Medicare & Medicaid Services (CMS)
may require applicants to have lived in the United States for a minimum of three
(3) years out of the last five (5) years to be employed with the Company. These
years of residence do not have to be consecutive.
Background Investigation: If you are selected for this position, you must
undergo a pre-employment Background Investigation, Drug Screen, and Identity
Proofing documentation must be cleared prior to hire. Most positions are subject
to additional Identity Proofing, Fingerprinting and additional Background
Investigation screening conducted by the Federal Government to be granted
Enterprise User Administration (EUA) system logical access after you begin your
employment. Your continued employment is contingent upon the outcome of the
complete additional screening criteria required for the position which must find
that you meet the applicable government customer's requirements (e.g., suitable
for access to CMS information and information systems), as well as any
additional investigation which may be required throughout your employment. If
you are found not suitable, your employment may be subject to corrective action,
up to and including immediate termination of employment.
Identity Documentation: You must have access to a current and unrestricted REAL
ID, U.S. Passport, U.S. Passport Card, Foreign Passport, or U.S. Permanent
Residency Documents. Note: Employment Authorization Cards (EAD) are not a
substitute for Visas or U.S. Permanent Resident Cards.
"We are an Equal Opportunity/Protected Veteran/Disabled Employer."
This opportunity is open to remote work in the following approved states: AL,
AR, FL, GA, ID, IN, IO, KS, LA, MS, NE, NC, ND, OH, PA, SC, TN, TX, UT, WV, WI,
WY. Specific counties and cities within these states may require further
approval. In FL and PA in-office and hybrid work may also be available.