Information Security Compliance Analyst

HMA Group Holdings, LLC; West Des Moines (IA); On-site; USD 70,000 - 95,000; Full time

Benefits offered by this job

Health, dental and vision

Paid parental leave

401k profit sharing

Continuing education & tuition Reimb.

Generous time-off

Volunteer time off

Diversity & inclusion programs

Job summary

Holmes Murphy & Associates in West Des Moines, IA, seeks an Information Security Compliance Analyst II to support the information security program, risk assessments, and policy development. You will oversee risk mitigation, vendor risk, and audits (SOC2 and others), mapping workflows for compliance and aligning with privacy policies and regulations such as NIST, HIPAA, NYDFS, or GLBA.

This role requires 3–5 years in information security or governance, with experience in GRC tools like Apptega or

Qualifications

• 3–5 years of experience in information security or governance.
• Strong knowledge of privacy policies and regulatory frameworks (NIST, HIPAA, NYDFS/GLBA).
• Experience in risk assessments and audit support.
• Familiarity with SDLC and compliance integration.

Responsibilities

• Support the information security program, including risk, policies, standards, and awareness.
• Lead risk assessments and provide detailed reports with mitigations.
• Oversee policy development to address regulatory requirements.
• Manage vendor risk assessments and third-party reviews.
• Review contractual agreements against compliance standards.
• Develop compliance metrics and reports for senior management and auditors.
• Mentor junior analysts and oversee documentation quality.
• Assist with SOC2 and other audits or assessments.

Skills

Privacy & compliance

Risk assessments

Regulatory knowledge

Security governance

Workflow mapping

Automation tools

Education

Associate/Bachelor's in cybersecurity

Tools

Apptega

Archer

Job description

Information Security Compliance Analyst II - West Des Moines, Iowa

We are looking to add an Information Security Compliance Analyst II to join our Information Security team in West Des Moines, Iowa.

Essential Responsibilities

• Support the information security program, including initiatives related to strategy, policies, standards, risk management, awareness, and training.
• Support the enhancement of the Enterprise’s overall governance program.
• Conduct comprehensive risk assessments and provide detailed reports on findings and required mitigations.
• Lead the development and maintenance of policies, ensuring they address regulatory requirements.
• Oversee implementation of risk mitigation controls, risk management, and conduct follow-up audits.
• Manage vendor risk assessments, working with third parties to address any gaps.
• Review contractual agreements against compliance standards in alignment with HMA contractual requirements.

Additional Responsibilities

• Develop and present compliance metrics and reports to senior management and auditors.
• Mentor junior analysts and oversee documentation quality.
• Lead special compliance projects, ensuring alignment with strategic goals.
• Assist with the annual SOC2 audit and other audits or assessments as appropriate.

Knowledge, Skills and Abilities

• Strong understanding and application of privacy policies, compliance standards and regulations such as NIST, HIPAA, NYDFS or GLBA.
• Solid knowledge of GRC tools such as Apptega, Archer, etc.
• Broad technical knowledge of network, cloud, and application security.
• Ability to conduct internal and external risk assessments and identify various types of risks, including operational, cybersecurity, regulatory, and reputational risks.
• Proficient with mapping and analyzing workflows to identify points of inefficiency, risk, or non-compliance.
• Strong understanding of SDLC and experience in compliance integration.
• Experience using automation tools within the work environment.
• Ability to participate in internal and external educational opportunities to enhance knowledge of current insurance topics or relevant system improvements.
• Ability to be available for work on a daily basis and extended hours as necessary.
• Ability to pursue relevant designations and/or continuing education, as appropriate.
• Ability to apply common sense understanding to carry out instructions furnished in written, oral or diagram form.
• Ability to deal with problems involving several concrete variables in standardized situations.
• Physical capability to lift, carry, push, or pull up to 10 pounds occasionally.
• Must be knowledgeable of and comply with HMA's Client Privacy Policy, HIPAA regulations and E&O procedures and policies.

Qualifications

• Education: Associate’s or Bachelor’s degree in cybersecurity, technology, information systems, or related area or an equivalent combination of education, training, and experience.
• Experience: 3-5 years of relevant experience in Information Security, compliance, governance, or other security-related fields.
• Relevant certifications preferred.

Core Competencies

• Trust – Build trust through honest and caring actions and consistently do the right thing.
• Communication – Seek understanding to convey messages and information to others in a caring and constructive manner.
• Client Focus – Establish meaningful relationships with clients (internal and external) by supporting their unique potential and delivering an impactful experience.
• Teamwork – Contribute to the success of the organization by effectively influencing others and uplifting team members.
• Business & Technology Knowledge – Invest in the development of technical knowledge, understand business needs to make informed decisions and deliver technology solutions, including effective related processes and procedures.
• Problem Solving – Identify problems, leverage resources to determine root cause, and propose and implement solutions or make improvements.

Benefits

• Health, dental and vision.
• Paid parental leave and supportive new parent benefits.
• Company‑paid continuing education & tuition reimbursement.
• 401k profit sharing with lump‑sum contributions for all full‑time employees.
• Generous time‑off practices in addition to paid holidays.
• Paid volunteer time off and matching gifts to charities through Holmes Murphy Foundation.
• Inclusion & belonging programs, including Uniquely United diversity initiatives.
• Consistent merit increase and promotion opportunities reviewed annually.
• Discretionary bonus opportunity.

Holmes Murphy & Associates is an Equal Opportunity Employer.