Lead Security and Privacy Compliance Analyst

• • Supporting the Information Security team with ongoing compliance efforts related to SOC 2, ISO 27001, and HITRUST certification, along with general state and federal healthcare, privacy, and security requirements.
  • Take point on all NIST-related audits and related artifacts.
  • Develop and implement a comprehensive security risk management framework, ensuring it aligns with industry best practices and regulatory requirements.
  • Ensure the organization complies with relevant industry standards, regulations, and contractual obligations related to security.
  • Ensuring the organization complies with Federal and State regulations and policies as they relate to healthcare privacy and security.
  • Oversee regular security risk assessments to identify potential vulnerabilities and develop strategies to mitigate risks effectively.
  • Oversee the development, implementation, and maintenance of security and privacy policies, procedures, and protocols.
  • Maintaining a matrix of client compliance requirements and performing regular compliance reviews.
  • Stay current with emerging security threats, trends, and technologies to ensure the organization remains proactive in its security posture.
  • Provide guidance and support to business units on security, privacy, and compliance matters, acting as a subject matter expert.
  • Collaborate with internal stakeholders to ensure security and privacy controls are implemented and maintained across the organization.
  • Coordinate audits and assessments to assess the effectiveness of the security risk management program and ensure compliance with applicable regulations.
  • Develop and deliver security awareness training programs to educate employees on security risks, best practices, and compliance requirements.
  • Develop and maintain relationships with external partners, regulatory bodies, and industry organizations to stay informed of regulatory changes and collaborate on security initiatives.
  • Foster a culture of security awareness and accountability throughout the organization by promoting best practices and maintaining an effective risk management program.
  • Provide regular reports and updates to senior management and stakeholders on the state of security risk and compliance.
  • Evaluate and recommend security tools, solutions, and services to enhance the organization's security, privacy, and compliance posture.
  • Supervise and mentor more junior team members.
  • Continuously assess and improve the organization's security, privacy, and compliance programs.
  • Assist in the development and implementation of Business Continuity Planning and testing.
  • Maintain Arcadia's trust portal and manage access for existing and prospective customers.
  • Monitoring the implementation of any prescribed corrective actions resulting from client assessments.

Qualification and Experience - Required 

• • Good working knowledge of compliance as it relates to healthcare privacy and security, governance, and risk concepts and practices.
  • In-depth understanding of common security and privacy standards, regulations, and laws relating to a cloud software development company in the healthcare industry (e.g., HIPAA, HITECH, SOC 2, ISO 27001/2, ISO 27017, HITRUST).
  • 5+ years' experience in performing information security audits, risk assessments, cyber risk management, or compliance.
  • Experience in vulnerability management, including lifecycle, follow-up, and reporting.
  • Background in healthcare technology, EHR (electronic health record) implementation, and healthcare compliance.
  • Strong understanding of HIPAA, Medicare, and Medicaid requirements
  • Ability to work independently.
  • Proficient in documenting risk and compliance activities, including how to ensure documentation is actionable rather than for the mere sake of compliance.
  • Experience in performing information security audits or risk assessments and familiarity with conducting security auditing processes professionally.
  • Excellent interpersonal, communication, and presentation skills and a level of professionalism in dealing with third parties.
  • Experience in developing security standards and guidelines based on best practices and industry standards.
  • Advanced computer skills and excellent written and oral communication skills.

Qualification-preferred 

• • At least 5-10 years of healthcare compliance experience.
  • Knowledge of securing network technologies, client, and server operating systems.
  • Certifications: CISA, ISACA, CIPP, CISSP, CISM.
  • Management of regulatory, internal, or external audits, or experience as an auditor.
  • Experience reviewing and redlining security terms in contracts.