Manager-Information Security Risk & Compliance (Remote)

American Specialty Health Incorporated (ASH) is seeking a Manager-Information Security Risk & Compliance to join our Information Security department.

The purpose of this position is to perform and oversee assigned day-to-day information security compliance tasks.

Remote Worker Guidelines

• Remote Worker Guidelines: This position will be trained remotely and must be able to work from home (WFH) in a designated work area with company-provided technology equipment. This WFH position requires you have a stable connection to your Internet Service Provider with the ability to participate by video in online meetings over a reliable and consistent network. The internet connection must have a consistent 50 down/10 up Mbps minimum internet speed. 100 down/20 up is recommended to support higher quality video meetings.

Responsibilities

• Performs Information Security Compliance tasks and projects.
  • Maintains and improves risk assessment processes, perform risk assessments, and updates the risk register.
  • Assists with maintaining compliance with industry regulations, policies, and procedures.
  • Makes recommendations to the manager for improvements to increase the effectiveness within Information Security.
  • Collaborates with the information security operations and compliance teams to streamline processes.
  • Represents the Information Security team by responding to exception and advisory requests.
  • Analyzes, and tracks metrics for dashboards, key performance indicators (KPIs), and scorecard.
  • Reviews risk and escalates identified anomalies and concerns to the manager.
  • Prepare metrics and reporting for Executive leadership.
  • Assists with HITRUST requirements and evidence gathering.
  • Performs internal security audits.
  • Maintains risk register in the GRC system.
• Oversees Information Security Risk and Compliance Program
  • Oversees day-to-day tasks enforcing quality and on-time deliverables.
  • Assists staff with career development.
  • Acts as subject matter expert to provide guidance for decision making.
• Attends industry seminars, conferences, and training classes to update knowledge and skills.
• Performs other duties as assigned.
• Complies with all policies and standards.

Qualifications

• Bachelor’s Degree in applicable field, such as Information Security, Information Technology, Computer Science, Business Administration, or equivalent experience required. If equivalent experience, High School Diploma required.
• 5 years of directly related experience in IT, Information Security, or IT Audit required.
• Experience working in a regulated environment, such as healthcare, preferred.
• Strong understanding of information security, risk management, and audit.
• Demonstrated knowledge of administrative, technical, and physical security controls.
• Demonstrated knowledge of different risk assessment methodologies.
• Knowledge of a security control framework; preferably HITRUST.
• Strong ability to successfully collaborate with a cross-matrix IT and business team environment.
• Experience conducting and managing internal and third-party IT control assessments.
• Strong analytical and critical thinking skills.
• Strong working knowledge of MS Outlook, Word, and Excel.
• Demonstrated ability to provide, both written and oral, concise and understandable communications and deliverables, especially for a non-technical audience.
• Ability to use good judgment and make risk-based decision as an advisor to the business on information security.
• Certified Information Systems Auditor (CISA) Upon Hire preferred.
• CISSP Certified Information Systems Security Professional Upon Hire preferred.

Core Competencies

• Demonstrated ability to interact in a positive, respectful manner and establish and maintain