Lead Risk and Compliance Analyst

Job Title

This job works collaboratively to support of all risk and compliance assessment activities of Highmark Health across a broad range of frameworks including NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO, etc.

Essential Responsibilities

• Provide input and consultation on risk and assurance reporting, along with terms and conditions in supplier contracts.
• Interpret inherent risk assessment results and develops third party and overall assurance plans to address relevant risk areas and to ensure proper controls are implemented.
• Oversee the delivery and timely completion of risk questionnaires and other risk assessments and leads impact assessment activates.
• Interprets complex data flow/ information sharing activities and information safeguards into simplified and high-level terminology and/or process/data flows.
• Maintain and review updates made to profiles, engagements, assessments, contracts, and other third party information in the RSA Archer.
• Interface with business areas, technical staff, project teams, and third parties to lead and execute cross-functional risk assurance projects.
• Responsible for ensuring departmental desk-level procedures, risk assessment methodology, assessment procedures, questionnaires, training, etc. are updated periodically.
• Other duties as assigned or requested.

Education

Required: Bachelor's Degree in Accounting, Finance, Business Administration/Management, Information Technology, Pre-Law, or related field.

Substitutions: 6 years of related and progressive experience in lieu of Bachelor's degree.

Preferred: Master's Degree in Accounting, Finance, Business Administration/Management, Information Technology, Pre-Law, or related field.

Experience

Required: 7 years in Audit and Compliance. To Include: 5 years of Business Process Design, 3 years in Project Management.

Preferred: None.

Licenses or Certifications

Required: None.

Preferred (any of the following): Certified Public Accountant (CPA), Certified Information Systems Auditor (CISA), Certified Information Privacy Professional (CIPP), Certified Information Systems Security Professional (CISSP).

Skills

Demonstrate expert knowledge of business and technology processes, risk and control frameworks, and assessment methodologies, particularly as applied to healthcare (payer and provider) business processes.

Knowledge of relevant regulatory guidelines, vendor management, sourcing and procurement, and completing assessments of vendors.

Excellent resource and project planning capabilities, decision making skills, history of results-oriented delivery, and effective team building across a cross-campus and diverse team of management and staff.

Strong written and verbal communication skills for diverse audiences (senior management, board, peer, and team).

Strong relationship building skills and ability to influence with and without authority in a matrixed organization.

Developed leadership qualities with an ability to motivate and inspire a group of individuals to achieve superior results.

High capacity to think analytically, interpret information / observations, apply judgment and make effective, strategic decisions.

Language (Other than English):

None

Travel Requirement:

0% - 25%

Physical, Mental Demands and Working Conditions

Position Type: Office-based.

Teaches / trains others regularly: Occasionally.

Travel regularly from the office to various work sites or from site-to-site: Rarely.

Works primarily out-of-the office selling products/services (sales employees): Never.

Physical work site required: Yes.

Lifting: up to 10 pounds Constantly.

Lifting: 10 to 25 pounds Occasionally.

Lifting: 25 to 50 pounds Rarely.