IT Risk Analyst (Remote Available)

Discover Vanderbilt University Medical Center:  Located in Nashville, Tennessee, and operating at a global crossroads of teaching, discovery, and patient care, VUMC is a community of individuals who come to work each day with the simple aim of changing the world. It is a place where your expertise will be valued, your knowledge expanded, and your abilities challenged. Vanderbilt Health is committed to an environment where everyone has the chance to thrive and where your uniqueness is sought and celebrated. It is a place where employees know they are part of something that is bigger than themselves, take exceptional pride in their work and never settle for what was good enough yesterday. Vanderbilt’s mission is to advance health and wellness through preeminent programs in patient care, education, and research.

Organization:

VEC ClinicalCyberRisk

Job Summary:

This position will conduct application risk assessments crucial to enterprise-wide systems. This position will provide support in security architecture and participate in incident response as dictated. This position will leverage IT risk management tools to determine appropriate measures for risk mitigation as needed. The position will be part of the Clinical Cyber Risk assessment team and is a critical component of processing assessments in a timely fashion and providing enhanced user training for VUMC employees and contractors.

.

KEY RESPONSIBILITIES
• Conducts application focused risk assessments.
• Assists application owners with security best practices.
• Participates in incident response activities related to systems.
• Executes passive and active user training activities.
• Monitors systems for suspect behavior.
• The responsibilities listed are a general overview of the position and additional duties may be assigned.

TECHNICAL CAPABILITIES
• Risk Assessment (Novice): Demonstrates familiarity with professional risk assessment processes and understands risk prioritization. Evaluates risks with an eye toward regulatory concerns while staying aware of current attack vectors. Identifies viable mitigation strategies that can be presented to business owners for consideration. Documents risk findings and suggested mitigations in a concise manner that can be clearly communicated to stakeholders.
• Regulatory Awareness (Novice): Demonstrates knowledge of healthcare regulations and security best practices. Identifies appropriate sources of governmental and industry guidance. Interprets regulations and guidance to assist application and business stakeholders with compliance and security best practice efforts.
• Security Control Knowledge (Novice): Understands and has direct familiarity with common information security technical toolsets (e.g. firewall, SIEM, IPS, vulnerability scanner, etc.). Demonstrates knowledge of non-technical controls (e.g. physical and administrative). Able to effectively communicate with teams directly administering controls to identify suitable responses to identified risks.
• User Training (Novice): Conducts formal, ad-hoc, and covert user training activities. Effectively communicates security risks to users of every skill level. Utilizes technical toolsets to aid and report on the training process (e.g. LMS, phishing campaigns, etc.)
• Incident Response (Novice): Understands incident response processes and is able to work in a professional manner during an incident. Serves as a liaison between technical and non-technical parties. Has an understanding of the forensic process and is able to identify appropriate skillsets necessary to handle investigative activity.

About the Department:

Vanderbilt Health - VUMC Enterprise Cybersecurity (VEC)

VEC provides information security service solutions for securing all administrative, clinical and research operations for all of Vanderbilt Health, the largest non-government employer in Middle Tennessee.

Vanderbilt Health is always growing, with our current environment of 7 hospitals, nearly 40K staff, over 40K workstations, over 160K network connections, and numerous data centers and cloud environments, securing our health system is truly a challenge!

To meet the challenge, VEC is led by 2 Vice Presidents and is structured with many dedicated teams, including: Active Vulnerability Assessment, Business Information Security Office, Business Resilience Services, Identity and Directory Services, Policy and Compliance, Security and Architecture Assurance, Security Engineer Services, Security Operations Center, and Threat Detection and Response.

VEC also employs state-of-the-art technology and partners with the many IT and operational teams across the enterprise to ensure a partnered, cohesive, and comprehensive approach to information security.

<