IT Security Analyst II — GRC & Vendor Risk Lead

Capital Health Screening Centre; Lawrenceville (GA); On-site; USD 108,000 - 141,000; Full time

Job summary

Capital Health is seeking an IT Security Analyst II to own core information security programs, including TPRM, phishing awareness, and application security assessments. This role provides policy interpretation and builds end-to-end programs with mentorship to junior staff.

You will assess risk across the organization, ensure regulatory compliance, and report on information security metrics to leadership while collaborating with IT and GRC teams.

Qualifications

• Bachelor's degree in a relevant field or equivalent experience.
• 3+ years in cybersecurity, GRC, vulnerability management or related roles.
• Working knowledge of NIST CSF, HIPAA, or similar frameworks.
• CompTIA Security+ required; CySA+/CRISC/ CISSP a plus.
• Strong ability to translate technical findings into business risk language.
• A+, Network+, Security+ certifications are a plus.

Responsibilities

• Owns end-to-end third-party risk management program, including risk scoring and vendor questions.
• Lead vendor risk assessments from outreach to closure with escalation as needed.
• Administers phishing simulation campaigns, analysis and reporting to leadership.
• Performs application security assessments for software, with risk-based recommendations.
• Manages software request/review process for security risk before onboarding.
• Supports GRC strategy with IT on phishing roadmaps and capacity planning.
• Drafts and maintains information security policies and tracks remediation progress.

Skills

NIST CSF

HIPAA

CompTIA Security+

GRC

Vendor risk management

Risk assessments

Security policies

Communication

Education

Bachelor's degree in a relevant field

Tools

Vulnerability management tools

Phishing simulation platform

Security monitoring tools

Job description

Capital Health is seeking an IT Security Analyst II to own core information security programs, including TPRM, phishing awareness, and application security assessments. This role provides policy interpretation and builds end-to-end programs with mentorship to junior staff.

You will assess risk across the organization, ensure regulatory compliance, and report on information security metrics to leadership while collaborating with IT and GRC teams.