Information Security Risk Analyst

Avera; Sioux Falls (SD); On-site; USD 71,000 - 107,000; Full time

Benefits offered by this job

PTO from day 1

Retirement matching up to 5%

Career development & mentorship

Equal Opportunity Employer

Job summary

Avera is seeking an IT Security Risk Analyst to assist in risk identification, control development, and evaluation across IT and business environments. You will support testings, policy updates, and remediation efforts while ensuring compliance with federal and state regulations.

Ideal candidates have 4–6 years in IT security or compliance, with CISA and CISSP certifications preferred, and will participate in audits, DR planning, and vendor risk assessments as part of a multidisciplinary team.

Qualifications

• Bachelor's degree in a related field is required or equivalent.
• CISA and CISSP certifications are highly preferred.
• 4–6 years of experience in IT security, risk, or compliance roles.
• Experience with IT controls, audits, and policy development.

Responsibilities

• Assess and improve the adequacy of the security strategy in IT and business environments.
• Plan, design, and coordinate business continuity and disaster recovery efforts.
• Test and evaluate IT controls; document deficiencies and remediation steps.
• Update information security policies, guidelines, and standards to meet laws.
• Support IT audits and vendor risk assessments; coordinate with internal teams.

Skills

Info security

Risk assessment

IT controls

Compliance

Auditing

Education

Bachelor's degree in related area

CISA

CISSP

Tools

SOC

ITGC testing tools

Job description

Location:Avera Downtown Building-Sioux FallsWorker Type:RegularWork Shift:Day Shift (United States of America)Pay Range:The pay range for this position is listed below. Actual pay rate dependent upon experience.$70,720.00 - $106,600.00Position HighlightsYou Belong at AveraBe part of a multidisciplinary team built with compassion and the goal of Moving Health Forward for you and our patients. Work where you matter.A Brief OverviewAssists in risk identification, development, and evaluation of information technology security controls including risk mitigation strategies as they apply to both IT and business environments. Delivers and supports evaluation of control designs, evaluation of control operation, reporting of control deficiencies, and remediation strategies. Reviews current processes for improvements in control documentation & testing for effectiveness and efficiency. Also collects and monitors information on security alerts, control failures/unmitigated risks and remediation results to build compliance reports for IT and business management. Provides advisory services for IT controls to projects, teams, and audits by ensuring consistent control implementation through documented processes for identifying control requirements prior to their implementation into production IT environments.What you will doActively participates in assessing and evaluating the current adequacy of the security strategy along with identifying and reporting on risks and controls in the IT and business environments.Assists with the planning, design, and coordination of business continuity/disaster recovery plans along with threats to the systems/organization, and calculating the impact of potential adverse events.Identifies, performs, and evaluates the current testing of controls while maintaining and improving the process for evaluation of IT controls through a combination of automated testing and interviewing.Identifies, analyzes and initiates changes in Information Security policies, procedures, guidelines and standards as needed to ensure overall compliance with federal, state, and local laws and regulations.Identifies and reviews current advances in all areas of information technology concerning vulnerabilities, security breaches or malicious attacks and current security risk areas for IT.Coordinates the planning, design, and implementation of legacy application record retention. This includes working with operational owners in evaluating and documenting the risks associated with proposed alternatives.Assists with internal technology teams on supporting internal and external IT audits. Assists with and performs internal security and risk assessments as requested by management. Audits and assessments must be continual, as the threat profiles change constantly.Coordinates implementation of processes and procedures to achieve industry accepted security audit certifications such as SOC.Assists with simulated emergency exercises as needed for security and business continuity related functions. Assists with Technology Intake Process in reviewing security aspects of vendor supplied products/service.Collects information on control failures/unmitigated risks, including a clear description of the risk and its likelihood along with remediation results to build compliance reports for IT and business management.Essential QualificationsThe individual must be able to work the hours specified. To perform this job successfully, an individual must be able to perform each essential job function satisfactorily including having visual acuity adequate to perform position duties and the ability to communicate effectively with others, hear, understand and distinguish speech and other sounds. These requirements and those listed above are representative of the knowledge, skills, and abilities required to perform the essential job functions. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job functions, as long as the accommodations do not cause undue hardship to the employer.Preferred Education, License/Certification, or Work Experience:Bachelor's in related areaCertified Information Systems Auditor (CISA) - ISACACertified Information Systems Security Professional (CISSP) - International Information System Security Certification Consortium (ISC2)4-6 years Related experience in IT, project management, compliance or security areasExpectations and StandardsCommitment to the daily application of Avera’s mission, vision, core values, and social principles to serve patients, their families, and our community.Promote Avera’s values of compassion, hospitality, and stewardship.Uphold Avera’s standards of Communication, Attitude, Responsiveness, and Engagement (CARE) with enthusiasm and sincerity.Maintain confidentiality.Work effectively in a team environment, coordinating work flow with other team members and ensuring a productive and efficient environment.Comply with safety principles, laws, regulations, and standards associated with, but not limited to, CMS, The Joint Commission, DHHS, and OSHA if applicable.Benefits You Need & Then SomeAvera is proud to offer a wide range of benefits to qualifying part-time and full-time employees. We support you with opportunities to help live balanced, healthy lives. Benefits are designed to meet needs of today and into the future.PTO available day 1 for eligible hires.Up to 5% employer matching contribution for retirementCareer development guided by hands-on training and mentorshipAvera is an Equal Opportunity Employer - Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, Veteran Status, or other categories protected by law. If you are an individual with a disability and would like to request an accommodation for help with your online application, please call 1-605-504-4444 or send an email to [e-mail] .