Apply on Employer Site

Paytient · 2 days ago

Information Security Analyst, GRC

United States

Full-time

Remote

Entry, Mid Level

2+ years exp

Paytient is on a mission to help people access and afford healthcare. They are seeking an Information Security GRC Analyst to ensure compliance with security frameworks and manage risk management programs, focusing on aligning policies with SOC2 and HITRUST standards.

Employee BenefitsFinTechHealth CarePayments

Responsibilities

Manage the alignment of internal policies, procedures, and controls with the HITRUST CSF and SOC2

Collaborate with stakeholders to draft and update information security policies and standards, ensuring they are well-designed and meet stringent requirements

Act as a primary participant in SOC2 and HITRUST assessments and audits, managing evidence gathering, documentation, and technical interaction with external auditors

Work closely with IT and Security teams to verify that controls are designed correctly and operating effectively within our environment

Assist in identifying vulnerabilities and participate in risk assessments for proposed business changes to ensure they do not compromise our compliance posture

Facilitate the Vendor Management Program by performing third party risk reviews for a broad range of technology vendors and reporting risk findings to technology stakeholders

Qualification

HITRUST CSFSOC2Risk ManagementInformation SecurityVendor ManagementTechnical AcumenJiraGoogle WorkspaceGRC PlatformsWritten Communication

Required

Verifiable experience leading or playing a high-level role in a successful Information Security GRC program that encompasses vendor lifecycle management, alignment with compliance frameworks, and risk management

2+ years in Information Security, IT Audit, or a Security GRC role

A strong understanding of networking, operating systems, cloud security, and encryption

An in-depth knowledge of HITRUST CSF and SOC2 and a working knowledge of NIST and ISO 27001

Exceptional written communication skills with the ability to create clear, accurate documentation that stands up to auditor scrutiny

Experience with Jira, Google Workspace, and GRC platforms such as Vanta, Drata, or similar products