Senior Cybersecurity Analyst (GRC)

POSITION SUMMARY: The Senior Cybersecurity Analyst (Governance, Risk, and Compliance) plays an important role in building and maturing Boston Medical Center Health System’s GRC program. This role will be key to developing and improving human-driven processes before enterprise tooling is in place, and will make that work visible, auditable, and ready to scale. Position: Senior Cybersecurity Analyst Department: Information Security Schedule: Full Time ESSENTIAL RESPONSIBILITIES / DUTIES: Lead execution of GRC program initiatives, contributing design input on processes, workflows, and work products as the program matures toward enterprise tooling adoption. Maintain and operationalize risk registers, control frameworks, and maturity assessments aligned to NIST CSF 2.0, HIPAA/HITECH, and applicable federal and state security and privacy regulations. Drive compliance monitoring activities and recommend updates to security policies, standards, and procedures that balance regulatory rigor with operational practicality. Coordinate the third-party risk management process, including vendor risk assessments and ongoing vendor risk workflows. Apply risk scoring methodologies to support framework maturity tracking and quantified risk metrics, incorporating business continuity and disaster recovery considerations. Manage structured GRC work products in spreadsheet and document-based environments (e.g., Excel, SharePoint), keeping them accurate, accessible, and audit-ready on an ongoing basis. Translate technical findings into clear, actionable written and verbal reporting for executive and non-technical audiences. Partner with stakeholders across IT and non-IT business functions to advance new standards and workflows, influencing adoption without direct authority. Prioritize multiple concurrent workstreams to deliver accurate results on schedule in a fast-paced, evolving environment. (The above statements in this job description are intended to depict the general nature and level of work assigned to the employee(s) in this job. The above is not intended to represent an exhaustive list of accountable duties and responsibilities required) JOB REQUIREMENTS REQUIRED EDUCATION AND EXPERIENCE: Bachelor's degree in Cybersecurity, Computer Science, Information Management, or a related field preferred A minimum of six years of experience in information security or related discipline, with a strong focus on governance, risk, and compliance programs in complex or regulated environments. Or equivalent combination of education and experience. PREFERRED EDUCATION AND EXPERIENCE: Demonstrated experience building or significantly maturing a GRC function, including the design of processes and workflows prior to enterprise tooling adoption. CERTIFICATIONS, LICENSES, REGISTRATIONS PREFERRED: Professional certifications such as CISA, CRISC, CISSP, or equivalent are highly desirable. KNOWLEDGE, SKILLS & ABILITIES (KSAs): Demonstrated experience in data mining, analysis and report development required. Strong knowledge of information systems security concepts and current information security/privacy trends and practices. Knowledge of Federal and State security and privacy-related regulatory requirements. Excellent written and oral communication skills, interpersonal skills, and effective leadership skills to support privacy programs. Must be able to prepare formal reports and presentations as needed. Must be detailed oriented and possess the ability to prioritize tasks so work is completed in an accurate, timely manner. Strong business and technical skills in the planning, administration, and management of information systems, operational and technical security controls; and security risk analysis and management. Self-starter with the ability to work independently, prioritize, multi-task, and maintain flexibility in fast-paced, changing environment. Ability to confront conflict and difficult issues in a professional, assertive, and proactive manner. Ability to build strong working relationships at all levels, internal and/or external to the organization. Knowledge about medical records and other medical information, patient privacy and confidentiality, and release of information. Academic medical center and/or health care consulting experience preferred. Compensation Range: $89,500.00- $130,000.00 This range offers an estimate based on the minimum job qualifications. However, our approach to determining base pay is comprehensive, and a broad range of factors is considered when making an offer. This includes education, experience, skills, and certifications/licensures as they directly relate to position requirements; as well as business/organizational needs, internal equity, and market-competitiveness. In addition, BMCHS offers generous total compensation that includes, but is not limited to, benefits (medical, dental, vision, pharmacy), discretionary annual bonuses and merit increases, Flexible Spending Accounts, 403(b) savings matches, paid time off, career advancement opportunities, and resources to support employee and family well-being. NOTE: This range is based on Boston-area data, and is subject to modification based on geographic location. Equal Opportunity Employer/Disabled/Veterans According to the FTC, there has been a rise in employment offer scams. Our current job openings are listed on our website and applications are received only through our website. We do not ask or require downloads of any applications, or “apps” job offers are not extended over text messages or social media platforms. We do not ask individuals to purchase equipment for or prior to employment. Working at Boston Medical Center is more than a job. It’s a chance to make a difference as part of our mission to provide exceptional and equitable care to all. As a nationally-recognized leader in health equity, nursing, initiatives to combat climate change, and many other areas, BMC is dedicated to improving the health of our community in Boston and beyond. BMC’s mission to provide exceptional care without exception extends to our employees, and we have been recognized as a top employer and best place to work. A strong sense of teamwork and support for our staff are the bedrock of BMC, as we know that we can only provide exceptional care to patients when our staff are cared for too. Boston Medical Center is an equal employment/affirmative action employer. We ensure equal employment opportunities for all, without regard to race, color, religion, sex, national origin, age, disability, veteran status, sexual orientation, gender identity and/or expression or any other non-job-related characteristic. If you need accommodation for any part of the application process because of a medical condition or disability, please send an e-mail to View email address on click.appcast.io or call View phone number on click.appcast.io to let us know the nature of your request. Boston Medical Center participates in the Electronic Employment Verification Program. As an E-Verify employer, prospective employees of BMC must complete a background check before beginning their employment at the hospital. BMC requires all staff to be vaccinated against COVID-19 and flu, as well as receive a booster dose of the COVID-19 vaccine. According to the FTC, there has been a rise in employment offer scams. Our current job openings are listed on our website and applications are received only through our website. We do not ask or require downloads of any applications, or “apps” job offers are not extended over text messages or social media platforms. We do not ask individuals to purchase equipment for or prior to employment. To avoid becoming a victim of an employment offer scam, please follow these tips from the FTC: FTC Tips