Sr GRC Analyst

The Aspen Group (TAG) is one of the largest and most trusted retail healthcare business support organizations in the U.S. and has supported over 20,000 healthcare professionals and team members at more than 1,300 health and wellness offices across 48 states in four distinct categories: dental care, urgent care, medical aesthetics, and animal health. Working in partnership with independent practice owners and clinicians, the team is united by a single purpose: to prove that healthcare can be better and smarter for everyone. TAG provides a comprehensive suite of centralized business support services that power the impact of five consumer-facing businesses: Aspen Dental, ClearChoice Dental Implant Centers, WellNow Urgent Care, Chapter Aesthetic Studio, and Lovet. Each brand has access to a deep community of experts, tools and resources to grow their practices, and an unwavering commitment to delivering high-quality consumer healthcare experiences at scale.

Business needs and our continued growth has created an opportunity to join our team as a Senior GRC Security Analyst.

Job Overview:

The senior governance, risk and compliance (GRC) security analyst is a highly respected, influential and in-demand role within the business. The position is responsible for supporting the security direction of the business and elevating the company’s security posture. The senior GRC security analyst is expected to support the security strategy of the business within new and existing information system capabilities. Consequently, the position requires both an understanding of legacy systems, as well as new technologies and requirements. The senior GRC security analyst is also responsible for the planning and design of policies and maintenance.

The ideal candidate is technical and possesses at least five years of experience in security, compliance, or risk management. The role oversees the business’ security requirements and obligations mandated by standards and regulations such as the Sarbanes-Oxley Act (SOX), California Consumer Privacy Act (CCPA), Health Information Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standard (PCI DSS). In tandem with security leadership, the senior GRC security analyst consistently assesses and validates the assurance of the security program. As a primary point of contact for internal and external auditors, the senior GRC security analyst monitors progress and enforces resolution of outstanding issues that may lead to non-compliance or security threats to the business. As a key member of the security team, the senior GRC security analyst must focus on strong risk management and corporate resiliency, and not be driven solely by compliance.

Responsibilities:

• Conduct enterprise-wide, ongoing risk analysis in tandem with compliance and security.

• Maintain oversight in GRC-related platforms.

• Identify strengths and weaknesses in the security program as they relate to privacy, security, business resiliency and compliance frameworks.

• Document, formulate and enforce areas of security improvement that balance risk with business operations and do not diminish efficiencies or innovation.

• Maintain strong oversight of third parties, vendors and business partners to safeguard against undue risk presented by external entities. Escalate to security management and business unit leads when points of weakness are discovered.

• Analyze findings, and document, recommend and report program gaps to security leadership.

• Monitor current and proposed security changes impacting regulatory, privacy and security industry best practice guidance. Apply GRC expertise across key lines of business, including products, practices and procedures.

• Ensure security and technology teams maintain up-to-date configuration documentation for systems and processes. Maintain rigorous oversight of security systems and security configuration administration to reduce risk to enterprise systems and accounts.

• Act as a key participant in incident response to track occurrence and resolution, with strict documentation and reporting.

• Work in tandem with security, audit and risk management leadership to perform ongoing security program assessments and create annual strategic technology and budgetary directives.

• Attend and fully engage in change and project management meetings.

• Liaise with auditors, both internal and external, to maintain and implement controls for compliance and privacy laws.

• Act as a point of contact for disaster recovery and business continuity as it relates to security frameworks, compliance and privacy laws.

• Mentoring and coaching of junior GRC analysts

• Perform other duties as assigned.