Lead Privacy Compliance Analyst

001_BCBSA Blue Cross and Blue Shield Association; Chicago, Washington (IL, District of Columbia); Hybrid; USD 143,000 - 208,000; Full time

Benefits offered by this job

Annual bonus

Medical/dental/vision insurance

401(k) matching

Job summary

Blue Cross Blue Shield Association is seeking a senior privacy and information security leader to establish and govern privacy controls, lead investigations, and drive compliance across the enterprise. You will manage training, audits, and vendor risk while aligning with SOC2, NIST, and HITRUST frameworks.

A strong background in HIPAA and PHI protection is required. The role offers a competitive salary range and comprehensive benefits, with annual bonus eligibility and a culture of collaboration

Qualifications

• Bachelor's Degree in Information Technology or related field required.
• Master's Degree or MBA preferred.
• Experience with unified control frameworks, policy management, internal/external audit management, and data loss prevention.
• Experience with 3rd party risk management.
• Experience with GRC technology (Archer, OpenPages).
• Privacy, information security, governance, risk and compliance management experience.

Responsibilities

• Develops and maintains a privacy governance program and controls to minimize risk.
• Lead privacy investigations, incident response, and awareness training.
• Support IT control management, third party risk management, and SOC2/HITRUST alignment.
• Ensure regulatory compliance for HIPAA and other laws.
• Oversee de-identification, encryption, and access controls of PHI/PII.

Skills

Privacy governance

Information security

Risk management

GRC tooling

Project management

Vendor management

NIST compliance

HIPAA knowledge

Education

Bachelor's degree in IT or related field

Master's degree or MBA (preferred)

CIPP certification

Tools

Archer

OpenPages

Job description

A career with the Blue Cross Blue Shield Association allows you to be part of the organization that supports Blue Cross and Blue Shield companies nationwide. We seek to improve health care quality, affordability, and accessibility for all Americans, and we want you to join the team! Driven by our North Star, to expand access to high-quality, affordable care for every community we serve, we foster a culture grounded in collaboration, accountability, and continuous improvement. Our people experience is built on meaningful work, competitive total rewards, and opportunities for growth, empowering you to make an impact while thriving both professionally and personally.

Job Description Summary

The role provides the thought leadership in the discipline of Privacy and is responsible for establishing and maintaining privacy processes, policies, standards, and procedures. The position supports privacy investigations and incident response and leads efforts to train and drive awareness entity wide on privacy practices. It also assist in the execution of other governance, risk and compliance related processes including, IT Control Management and Compliance, Policy Management, Third Party Risk Management, SOC2 attestation, NIST Cybersecurity and HITRUST framework alignment, Security awareness, Risk assessment methodology and execution.

Data Loss Prevention Job Description

Develops and maintains privacy governance and compliance controls to minimize risk to the organization. This includes, but is not limited to, developing and maintaining of a formal privacy program with corresponding processes, policies, standards and procedures; and ensuring compliance to HIPAA and other State or Federal regulatory requirements. Establishes and maintains processes to identify gaps in privacy controls. This includes, but is not limited to, reviews / audits of departmental processes, policies, and procedures; reviews / audits of third party vendors; testing of regulatory compliance to HIPAA and other State or Federal requirements; plus development and analysis of metrics. Develops and maintains a formal privacy and information security training program, as well as supplementing that training with ongoing awareness. This includes online training supplemented with classroom and individual training. Utilizes reports and metrics to demonstrate training compliance and effectiveness. Provides direction and oversight for BCBSA initiatives related to de-identification, masking, and/or encryption of protected health information (PHI) or other personally identification information (PII). Maintains the BCBSA System wide Incident Response Guidance (SWIRG), the BCBSA Privacy Response Plan, and List Serves, and performs exercises of the plan internally and with external stakeholders on a periodic basis. Provides oversight on access to and release of protected health information (PHI) and other personally identifiable information (PII), performing periodic reviews of both. Collaborates with BCBS organizations to share best practices, and either leads or assists with establishing the Privacy & Information Security track for each Blue National Summit (BNS). Helps ensure third party vendor compliance to BCBSA privacy and information security requirements, reviewing third party questionnaires, engaging Legal and Procurement on disputes, ranking relative risk of third parties, and leading or participating in third party on-site vendor audits. Helps maintain a framework of controls to safeguard BCBSA sensitive data, and oversees compliance to those controls, utilizing manual and automated processes supplemented with reporting metrics.

The posting range for this position is: 143,300.00 - 207,800.00

Qualifications

• Education Required Bachelor's Degree Information Technology or related field required; or equivalent work experience.
• Preferred Master's Degree or MBA.
• Experience Required 7+ Years privacy, information security, planning, administration, audit, or resource and compliance management role.
• Experience supporting privacy initiatives; implementing or maintaining policies, processes and procedures; and implementing training and awareness programs.
• Experience with unified control frameworks, policy management, internal/external audit management, and data loss prevention.
• Working experience in managing 3rd party risk.
• Experience in working with GRC technology (e.g., Archer, Open Pages).
• Privacy, information security, planning, administration, audit, or resource and compliance management role experience.

Knowledge Skills and Abilities

• Must have a full understanding of legal and regulatory requirements relating to Privacy in the healthcare sector including Federal and State legislative mandates and requirements to safeguard Protected Health Information (PHI) and/or Personally Identifiable Information (PII). This also includes experience with the Health Insurance Portability and Accountability Act (HIPAA).
• Working knowledge of integrating security compliance requirements and artefacts into the project management lifecycle and SDLC.
• Knowledge and experience in project and change management.
• Knowledge of the BCBS system and practices.
• Knowledge of vendor management and contract administration.
• Relationship, facilitation, presentation and communication skills; ability to collaboratively plan, document, and present privacy risks and achieve buy-in from system custodians and business owners.
• Preferred: Demonstrates AI literacy and an understanding of generative AI tools, including appropriate business applications and limitations.

Certifications & Licenses Required

• Certified Information Privacy Professional (CIPP) - IAPP #LI_HYBRID

The posted salary range is the lowest to highest salary we, in good faith, believe we would pay for this role at the time of this posting. We may ultimately pay more or less than the hiring range and this hiring range may also be modified in the future. A candidate’s position within the hiring range may be based on several factors including, but not limited to, specific competencies, relevant education, qualifications, certifications, relevant experience, skills, seniority, performance, shift, travel requirements, and business or organizational needs. This job is also eligible for annual bonus incentive pay. We offer a comprehensive package of benefits including paid time off, 11 holidays, medical/dental/vision insurance, generous 401(k) matching, lifestyle spending account and many other benefits to eligible employees.

Note: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable. The amount and availability of any bonus, commission, or any other form of compensation that are allocable to a particular employee remains in the Company's sole discretion unless and until paid and may be modified at the Company’s sole discretion, consistent with the law.

NOTICE OF USE OF ARTIFICIAL INTELLIGENCE

Blue Cross and Blue Shield Association (“BCBSA”) is committed to ensuring compliance with federal, state, and local laws governing the use of technology in the employment context. BCBSA uses artificial intelligence (“AI”) tools to assist with our recruitment process. All hiring decisions remain subject to human review and oversight.

At Blue Cross Blue Shield Association (BCBSA), we are a national association of 33 independent, community-based and locally operated Blue Cross Blue Shield companies and we are driven by purpose. Join the team who supports the nation's largest healthcare network, providing coverage to nearly one in three Americans as we relentlessly pursue affordable healthcare and ensure peace of mind for the people we serve. Be part of our storied history of innovation as we advance well-being and health equity. Experience a culture that is built on our core values, connection, work-life flexibility, well-being, and a commitment to our community. If you thrive at a company that values inclusivity, accountability, courage, teamwork, and respect, we're glad you found us!