Senior Monitoring Analyst

Company :

Highmark Health

Job Description : 

JOB SUMMARY

This job performs governance, risk, and compliance (GRC) risk monitoring and executes risk treatment processes and activities.  This includes monitoring, tracking, and reporting on risk across second line of defense functions (i.e., privacy, compliance, information security, quality, legal) and supporting a broad range of frameworks including NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO, NCQA, the BCBSA, etc.  The incumbent is responsible for executing continuous monitoring of enterprise policies, standards, procedures/controls, business continuity/disaster recovery plans, etc. aimed to detect, prevent, and respond to risks across the enterprise risk taxonomy.  Develops and oversees suite of multi-disciplinary risk monitoring reports. Applies risk decisioning criteria and exception handling criteria, and ensures risk treatment solutions are delivered according to contractual and other service-level obligations.  Leads implementation and monitoring of corrective action measures based on internal or external audits/examinations.  Seeks input on quality and effectiveness of own work while also takes responsibility to review the work of others for quality, adherence to standard practices and procedures, and to determine the realization of measurable risk treatment outcomes. May take on role project leadership roles for special assignments. Assists with mentoring less experienced team members. Has a proactive mindset and approach and feels comfortable working in a highly matrixed environment.

ESSENTIAL RESPONSIBILITIES

• Develops and executes a monitoring function intended to prevent, detect, and respond to risks, in partnership with business units and Senior Risk Partner (SRPs).  Works with business units and other ERG constituents to prioritize monitoring activities. 
• Develops programs and executes reporting and monitoring activities pertaining to known issues as well as threat and vulnerability scan reporting on applications, networks, operating systems, etc. to identify risk. 
• Monitors current compliance environment including corporate policies and procedures and other rules and regulations through trend and other data analysis.  Leads creation and adoption of ad-hoc and other reports pulling data from various sources and/or run system reports.  Conducts complex analysis on reports and data sets to ensure systems and/or results meet expected thresholds/tolerances.
• Monitors Corrective Action / Remediation Plans, as necessary;  reviews and analyzes results against expectations/benchmarks and communicates outcomes to management including Senior Risk Partners (SRPs). Applies relevant reporting and data analysis techniques to all work products.  
• Executes against and provides ongoing feedback on risk treatment methodology in partnership with Risk Strategy (avoid, accept, transfer, mitigate).  Collaborates with other areas of Risk Operations to prioritize, to escalate, and to improve risk intelligence and risk assessment activities. 
• Researches, creates, and implements novel approaches to training and education on GRC process automation, reporting, and monitoring.  Contributes to knowledge management repositories and other communities of practice.
• Other duties as assigned or requested.

EDUCATION

Required

• Bachelor's Degree in Accounting, Business, Computer Science, Data Science, Finance, IT or related field

Substitutions

• 6 years of related and progressive experience in lieu of Bachelor's degree

Preferred

• None

EXPERIENCE

Required

• 5 years with governance, risk, and compliance technology or related reporting and monitoring experience, preferably with the Archer GRC suite and/or in a healthcare or healthcare related industry, with increasing responsibility.
• 3 years of interacting with regulators, auditors, and oversight bodies

Preferred

• 3 years of report design, multi-disciplined data aggregation and analysis
• 3 years of continuous controls and process monitoring

LICENSES or CERTIFICATIONS

Required

• None

Preferred (any of the following)

• Certified Public Accountant (CPA)
• Certified Information Systems Auditor (CISA)
• Juris Doctorate (JD)
• Certified Information Privacy Professional (CIPP)

SKILLS

• Strong knowledge of business and technology processes, risk and control frameworks, and assessment methodologies, particularly as applied to healthcare (payer and provider) business processes
• Strong knowledge of how to leverage technologies to drive efficient and effective GRC processes across payor/provider industries
• Demonstrated resource and project planning capa