FIND YOUR FUTURE

We're excited about the potential people bring to our organization. You can grow your career here while enjoying first-class perks, benefits and a culture that fosters growth, innovation and collaboration.

Overview

In recognition of the significant risk that third parties bring to Independent Health and its family of companies, the cyber security risk analyst (CSRA) will be responsible for the assessment of the organization's third-party vendors, partners, and suppliers. The CSRA will analyze and evaluate cyber security and privacy risks associated with the supply chain, including but not limited to hardware and software components, third-party services, and data management processes. The analyst will develop risk mitigation strategies and controls, including corrective action plans (CAPs), to ensure the security of the organization's supply chain and collaborate with the procurement, compliance, risk management, legal, and vendor management teams to ensure that cyber security and privacy requirements are included in the organization's contracts with suppliers and third parties. They will monitor and track cyber security risks associated with third parties and Independent Health and its family of companies and provide regular updates to senior management. This position will work with legal and business owners to contribute, review, and implement cyber security and privacy controls into third party and supply chain contracts. They will stay up to date with emerging cyber security threats and trends in the third-party risk industry. This role will also assist in executing our enterprise-wide cyber security risk assessment and fulfillment of internal and external audit, regulatory, and client requests for inquiry on our enterprise cyber security and privacy program.

Qualifications

• High school diploma or GED required. Bachelor’s degree preferred.
• Five (5) years of experience encompassing cyber security, governance, audit, risk management, third-party risk management or internal control assessment.
• Industry recognized certifications within the domain of information security, information technology and privacy (e.g., CISSP, GIAC, CISM, ITIL, CIPP/US, etc.) preferred.
• Knowledge of NIST CSF, ISO 27001/2, HIPAA, HITRUST, SSAE16 (SOC 1 and SOC 2), COBIT, ITIL or other cyber security and privacy frameworks control standards required.
• Experience using, maintaining, and developing governance, risk, and compliance software solutions.
• Able to make independent risk-based decisions with consideration for business and operational goals and constraints.
• Excellent planning and problem-solving skills; must have high attention to detail and quality of work deliverables; must show strong customer service orientation.
• Excellent oral and written communication skills, as well as the ability to convey security, technical and privacy related issues to business audience.
• Ability to work with a team as well as diverse workgroups on prevention, identification, and resolution of privacy and security problems.
• Proven examples of displaying the IH values: Passionate, Caring, Respectful, Trustworthy, Collaborative and Accountable.

Essential Accountabilities

• Conduct cyber security and privacy risk assessments of the organization's third-party vendors, partners, and supply chain.
• Analyze and evaluate cyber security and privacy risks associated with the supply chain, including but not limited to hardware and software components, third-party services, and data management processes.
• Develop, make, and implement risk mitigation strategies and controls to ensure the security and privacy of the organization's supply chain.
• Issue and execute CAPs as deemed necessary.
• Develop, implement, and maintain the cybersecurity continuous monitoring program for third party vendors and Independent Health and its family of companies to identify vulnerabilities, gaps, remediation, and maintain acceptable scores.
• Collaborate with procurement, compliance, business continuity and disaster recovery, risk management, finance, and vendor management teams to ensure that cyber security requirements are included in the organization's contracts with suppliers and vendors.
• Monitor and track cyber security risks associated with the supply chain and provide regular updates to business owners and senior management.
• Stay up to date with emerging cyber security threats and trends in the supply chain industry.
• Follow all established processes and procedures in the accomplishment of risk assessment processes.
• Act independently and work through the risk assessment process, solving problems and challenges as they arise.
• Assist in coordinating, reviewing and