Lead IT Security Analyst

NYU Langone Hospitals; New York (NY); On-site; USD 120,000 - 160,000; Full time

Job summary

NYU Langone Hospitals is seeking a Lead IT Security Analyst to lead enterprise risk assessments and evaluate security in modern technology environments. The ideal candidate will have over 10 years of experience and a BA/BS degree. Responsibilities include overseeing risk assessments and ensuring compliance with standards such as HIPAA and HITRUST.

You will work collaboratively with IT, Security, and other stakeholders, focusing on cloud security and program improvement. Strong communication skills are essential.

Qualifications

• 10 or more years of experience in a similar role.
• Strong communication skills to effectively interact with all levels of the organization.

Responsibilities

• Lead the execution and maturation of the enterprise risk assessment program.
• Conduct and oversee complex risk assessments, including HIPAA and HITRUST evaluations.
• Lead security assessments of cloud and hybrid environments.
• Serve as a senior escalation point for complex or high-risk assessments.

Skills

Risk assessment methodologies

Cloud security assessments

Regulatory compliance

Mentorship skills

Education

BA/BS degree or equivalent

Job description

NYU Langone Health is a fully integrated health system that consistently achieves the best patient outcomes through a rigorous focus on quality that has resulted in some of the lowest mortality rates in the nation. Vizient Inc. has ranked NYU Langone the No. 1 comprehensive academic medical center in the country for three years in a row, and U.S. News & World Report recently placed nine of its clinical specialties among the top five in the nation. NYU Langone offers a comprehensive range of medical services with one high standard of care across 6 inpatient locations, its Perlmutter Cancer Center, and over 320 outpatient locations in the New York area and Florida. With $14.2 billion in revenue this year, the system also includes two tuition‑free medical schools, in Manhattan and on Long Island, and a vast research enterprise with over $1 billion in active awards from the National Institutes of Health.

Position Summary

Lead IT Security Analyst.

This position reports to the IT Controls & Regulatory Compliance Manager and serves as a senior individual contributor and subject matter expert responsible for leading enterprise risk assessments and evaluating the security of modern technology environments, including cloud-based platforms. The IT Controls Lead drives the design, execution, and continuous improvement of the organization’s risk assessment program to ensure compliance with regulatory and industry requirements, including HIPAA, HITRUST, PCI DSS, and FISMA. This role partners closely with IT, Security, Clinical, Research, and Compliance stakeholders to assess risk across enterprise systems, research technologies, and cloud infrastructure, and to ensure that security controls are appropriately designed and operating effectively.

Enterprise Risk Assessment Leadership

• Lead the execution and maturation of the enterprise risk assessment program aligned to regulatory and industry frameworks
• Conduct and oversee complex risk assessments, including HIPAA and HITRUST‑aligned evaluations
• Define and maintain risk assessment methodologies, scoring models, and standards
• Identify, analyze, and document risks, and develop actionable remediation strategies

Cloud Security & Technology Risk Evaluation

• Lead security assessments of cloud and hybrid environments (e.g., IaaS, PaaS, SaaS)
• Evaluate key control domains, including identity and access management, network architecture and segmentation, logging, monitoring, and detection capabilities, and data protection and encryption
• Assess alignment to frameworks such as HITRUST, PCI, NIST Cybersecurity Framework, and ISO/IEC 27001
• Partner with engineering and security teams to validate that controls are effectively implemented in real‑world environments

Research Technology & Clinical Risk Oversight

• Lead security and risk reviews of research technologies and data use cases, including systems handling sensitive or regulated data
• Partner with clinical and research stakeholders to evaluate emerging technologies and ensure appropriate risk controls are in place
• Provide guidance on secure design and data protection strategies

Cross‑Functional Leadership & Escalation

• Serve as a senior escalation point for complex or high‑risk assessments across enterprise systems, third‑party/vendor solutions, and cloud and research environments
• Provide subject matter expertise and mentorship to team members supporting assessments and compliance activities
• Influence decision‑making across stakeholders without direct authority

Regulatory & Audit Support

• Support internal and external audit activities by providing subject matter expertise, documentation, and control validation
• Ensure risk assessments and control evaluations align with regulatory expectations and audit requirements
• Partner with the IT Controls Manager on audit responses and remediation planning

Program Improvement & Innovation

• Identify opportunities to enhance assessment processes, tooling, and automation
• Contribute to development of metrics, dashboards, and reporting to measure risk posture and program effectiveness
• Drive continuous improvement in how risk is identified, assessed, and managed across the enterprise

Minimum Qualifications

• 10 or more years of experience in a similar role
• BA/BS degree or equivalent

Preferred Qualifications

• Advanced degree desirable
• Strong communication skills to effectively interact with all levels of the organization

NYU Langone Health is an equal opportunity employer and is committed to inclusion in all aspects of recruiting and employment. All qualified individuals are encouraged to apply and will receive consideration.