Information Risk & Compliance Leader

Highmark Health; United States; On-site; USD 79,300 - 127,100; Full time

Job summary

Highmark Health is seeking an Information Security Risk professional to partner with architecture, compliance, and business teams. The role focuses on proactive testing of security policies, translating risk into actionable mitigations, and ensuring alignment with PCI-DSS, HITRUST, and ISO 27001.

The position requires collaboration across projects to embed security controls and governance in solutions. The ideal candidate will have 7+ years in information security/risk, strong knowledge of

Qualifications

• Bachelor's Degree or higher in Information Security, Information Systems, Information Assurance, Computer Science or related field.
• At least 7 years' experience in Information Security, Governance, Risk and/or Compliance.
• Knowledge of HITRUST CSF, NIST 800-53/CSF, PCI, HIPAA/HITECH, COBIT, ISO 27001/2, ITIL 3.
• Familiarity with secure SDLC and risk assessment methodologies.

Responsibilities

• Conduct Information Risk Assessments and collect/verify documentation and interviews.
• Document and communicate risk assessment results to stakeholders.
• Perform risk scoring related to threat, vulnerability, likelihood, impact and controls.
• Maintain risk register tracking and risk statements.
• Follow up on exceptions, risk acceptance, corrective action plans, and mitigation.
• Explain risk treatment options: avoidance, acceptance, transference, mitigation.
• Collaborate with projects to apply security architecture requirements and remediation.
• Develop procedural documentation for PCI-DSS, HITRUST, ISO 27001 compliance.
• Lead with enGen teams on compliance documentation and standards.
• Present solution decks to management across technical levels.
• Support ongoing adherence to standards, procedures, and processes.

Skills

HITRUST CSF

NIST CSF 800-53

PCI DSS

HIPAA / HITECH

COBIT / ISO 27001

NIST Risk Assessment

Secure SDLC

AI Governance (NIST/ISO RMF)

Teamwork

Communication

Education

Bachelor's Degree in Information Security/Information Systems/Information Assurance/CS

Master's Degree in CS/Information Security (preferred)

Tools

IPS

Firewalls

Endpoint Protection

DLP

SIEM

Encryption

Virtualization

Job description

Highmark Health is seeking an Information Security Risk professional to partner with architecture, compliance, and business teams. The role focuses on proactive testing of security policies, translating risk into actionable mitigations, and ensuring alignment with PCI-DSS, HITRUST, and ISO 27001.

The position requires collaboration across projects to embed security controls and governance in solutions. The ideal candidate will have 7+ years in information security/risk, strong knowledge of