IT Security Auditor

Company Description

Privia Health™ is a technology-driven, national physician enablement company that collaborates with medical groups, health plans, and health systems to optimize physician practices, improve patient experiences, and reward doctors for delivering high-value care in both in-person and virtual settings. The Privia Platform is led by top industry talent and exceptional physician leadership, and consists of scalable operations and end-to-end, cloud-based technology that reduces unnecessary healthcare costs, achieves better outcomes, and improves the health of patients and the well-being of providers.

Job Description

Reports to the Sr. Manager of IT Audit & Security. The IT Security Auditor will be responsible for ensuring IT systems and procedures are secure, compliant with HIPAA, SOX, and HITRUST,  and aligned with industry best practices. They have experience in EMR, IAM, IGA, and access review tools, with strong analytical skills for identifying and addressing security risks. The IT Security Auditor collaborates with teams to ensure compliance with evolving security policies and workflows, focusing on access vulnerabilities. They assist in documenting governance processes and designing policy for approval workflows, privileged access management, and lifecycle management. Additionally, the IT Security Auditor supports the design, implementation, and refinement of SOX-related controls, user access reporting, and quarterly audits.

Primary Duties

• Assist with regular audits of user access controls, including reviewing user access requests and access logs, and producing audit reports to ensure that access is appropriate and in line with company policies and regulatory requirements.
• Assist with implementing and revising identity governance policy using IGA tools and technologies to ensure that privileged/admin access and non-privileged access are appropriately differentiated, with an emphasis on SOD analysis and controls.
• Design, implement, and test SOX controls related to user access and data security, with a focus on compliance with SOX and other relevant security regulations.
• Support the Access and Data Management where needed with a primary focus on the security policy of user provisioning across multiple systems, emphasizing the separation of duties (SOD) analysis and controls.

Experience with:

SECURITY

• Thorough understanding of healthcare regulatory frameworks and security standards such as the HIPAA Security Rule, NIST, and PCI DSS.
• Knowledge of the HITRUST CSF (Common Security Framework) and the HITRUST CSFCIS (CSF Control Implementation Support) Control Set to demonstrate the ability to meet industry best practices and regulatory requirements for securing healthcare data.
• Ability to utilize various audit tools to perform user access audits and produce comprehensive audit reports to identify risks and vulnerabilities in the organization's access management system.

SOX CONTROLS/AUDITS

• Experience in designing, implementing, and testing SOX controls related to user access and data security, such as Segregation of Duties (SOD), Least Privilege, and Access Recertification.
• Ability to conduct quarterly user access reviews and produce audit reports to ensure compliance with company policies and regulatory requirements.
• Understanding of IT General Controls (ITGCs) and their impact on financial reporting, such as change management, system development, and IT operations.

IAM/IGA/PAM

• Demonstrated experience with the implementation and administration of Identity and Access Management (IAM) solutions, such as Okta, Ping Identity, One Identity, ForgeRock, CyberArk, or similar.
• Strong understanding and experience with Identity Governance and Administration (IGA) solutions, such as SailPoint, Saviynt, or RSA Identity Governance, to manage access requests, entitlements, certifications, and compliance.
• Familiarity with industry standards and best practices such as NIST, ISO 27001, CIS, and PCI-DSS, as well as regulatory compliance frameworks, such as HIPAA, HITRUST, GDPR, CCPA, and SOX.

APPLICATION (Applications, Database, Interfaces)

• Basic knowledge in securing a three tier application architecture.
• Basic knowledge of cloud-based security architecture, including modern multi-cloud architectures, the difference between cloud and a virtual desktop or application environment hosted in a Citrix or VDI environment.
• Strong spreadsheet skills with Excel or Google Sheets including pivot tables and vlookups.

EHR/EMR

• Experience with application support for an EHR/EMR - athenaOne preferred.

Quali