Cybersecurity Analyst III

teladoc; India; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Teladoc Health in India seeks an Information Security Analyst III to support the Director of Governance, Risk and Compliance in strengthening internal controls to mitigate risks and ensure security and compliance across Teladoc.

The role collaborates with multiple departments, technology and operations, as well as clients and vendors, to ensure policies and controls are designed, implemented and operating effectively. The individual serves as a SME for security guidance and cloud integrations.

Qualifications

• Bachelor's degree from an accredited four-year program.
• Experience in cybersecurity, risk management, assurance and audit standards/frameworks.
• Experience with cloud environments (public and private) and mergers/due diligence.
• Knowledge of HIPAA, FDA, GDPR, PCI, SOX and related compliance requirements.

Responsibilities

• Manage Teladoc Health's cybersecurity program to keep pace with evolving threat landscape.
• Implement a continuous security and control assessment framework.
• Develop risk metrics to inform leadership and stakeholders.
• Act as information security SME to IT and business teams to identify threats and propose solutions.
• Perform risk assessments of cloud-based applications and track remediation of gaps.
• Assist with client RFI responses, contract negotiations, and security assessments.
• Onboard and conduct annual risk assessments of third-party providers.
• Document and update information security policies, standards and procedures.
• Promote enterprise security awareness and education.
• Prepare SSPs, RA reports, C&A packages, and SRTMs.

Skills

Cyber governance

Risk management

Compliance

Vendor risk

ISO 27001

NIST

HIPAA

GDPR

Security certifications

Cloud security

Education

Bachelor's degree

Job description

Join the team leading the next evolution of virtual care.

At Teladoc Health, you are empowered to bring your true self to work while helping millions of people live their healthiest lives.

Here you will be part of a high-performance culture where colleagues embrace challenges, drive transformative solutions, and create opportunities for growth. Together, we're transforming how better health happens.

Summary of Position

The Information Security Analyst III will support the Director, Governance, Risk and Compliance - Information Security in implementing, maintaining, and improving the internal control environment to mitigate risks and assure security and compliance of Teladoc. The individual will collaborate across various departments of the business, its technology, and operations groups as well as extemal parties such as clients and vendors of Teladoc to ensure compliance to implemented policies, procedures and related controls are designed, implemented and operating effectively. The individual assuming this role should possess required technical security expertise to be a Subject Matter Expert (SME) for security guidance, approvals, design, and integration of consistent security solutions across corporate and cloud environments.

Essential Duties and Responsibilities

• Manage Teladoc Health's cybersecurity program's ability to keep pace with changes in the overall threat landscape
• Implement a continuous security and control assessment framework
• Develop and maintain relevant risk metrics to promote transparency to peer teams, senior leadership, and any other relevant stakeholders.
• Act as information security SME to IT and business project teams to identify potential threats and recommend solutions and technologies.
• Perform continuous assessment of critical security controls for Teladoc's cloud-based applications and track them to ensure remediation of security gaps.
• Assist in client lifecycle activities related to information security such as RFI responses, contract negotiations or client-led standard information gathering or security assessments.
• On-boarding and annual risk assessments and due diligence exercises of potential third party service providers or partners.
• Document and implement information security policies, standards and procedures following established document formats/templates.
• Assist in the reviewing and updating of draft policies, standards, and procedures documents and solicit feedback from key intemal and extemal stakeholders, maintain version control.
• Establish and adhere to quality control standards for creating and internally publishing information security policies, standards, and procedures.
• Communicate with internal and external stakeholders the requirements in the information security policies and standards of Teladoc's Information Security and Risk Programs.
• Tasks include prepare, document and/or review System Security Plans (SSPs), Risk Assessment Reports, Certification and Accreditation (C&A) packages, and System Requirements Traceability Matrices (SRTMs). Perform risk assessment analysis and ATOS.
• Promote security education and awareness across Teladoc by enhancing the enterprise security awareness program.
• The time spent on each responsibility reflects an estimate and is subject to change dependent on business needs.

Supervisory Responsibilities

No

Qualifications Expected for Position

• Prioritization, time management and strong communication skills are essential for this role as, eventually, it will be managing activities with internal and external parties, both technical and non technical.
• Strong background in cyber governance, risk, and compliance Extensive experience in performing vendor risk assessments inventory maintenance and other data processing activities.
• Experience in cybersecurity, risk management, assurance, and audit standards/models/frameworks such as ISO 27001, NIST, HITRUST, FedRAMP, PCI, SOX, FDA, GDPR, HIPAA.
• Experience with integration of security programs after mergers and acquisitions including involvement of due diligence activities when required.
• Experience with risk management to secure cloud environments both public and private.
• Bachelor's degree from an accredited, four-year undergraduate program.
• Relevant Industry certifications such as CISA CISSP, CISM or any other.
• 5-7 years of experience in a purely information security role.
• Prior working experience performing HIPAA, HITRUST, FedRamp, NIST, ISO, GDPR, CCPA assessments.
• Working knowledge of IOT Medical Devices and FDA Postmarket/Postmarket requirements and UL2900-1/2.
• The above qualifications, knowledge, experience, and/or background are expected but not required for this role.

Travel

Travel: less than or equal to 10%

Physical Requirements

To perform this job successfully, an individual must be able to perform each essential job duty satisfactorily. Reasonable accommodations may be ma