Monitoring Analyst

Highmark Health; Pittsburgh (Allegheny County); On-site; USD 80,000 - 110,000; Full time

Job summary

Highmark Health is seeking a Governance, Risk and Compliance (GRC) specialist in Pittsburgh, who will perform risk monitoring and execute treatment processes while collaborating with business units. The ideal candidate will possess at least 5 years of relevant experience, particularly with the Archer GRC suite in a healthcare setting.

Responsibilities include monitoring compliance, conducting complex data analyses, and mentoring team members. Strong communication skills and a proactive approach are essential for success in this hybrid office position.

Qualifications

• 5 years experience in governance, risk, and compliance technology.
• 3 years engaging with regulators and auditors.
• Experience with Archer GRC suite preferred.

Responsibilities

• Develop and execute risk monitoring functions with business units.
• Monitor compliance environments and create analytical reports.
• Lead the creation and reporting of remediation plans.

Skills

Knowledge of risk and control frameworks

Strong project planning skills

Excellent communication skills

Leadership qualities

Relationship building abilities

Education

Bachelor's Degree in Accounting, Business, Computer Science, Data Science, Finance, IT or related field

Job description

This job performs governance, risk, and compliance (GRC) risk monitoring and executes risk treatment processes and activities. This includes monitoring, tracking, and reporting on risk across second line of defense functions (i.e., privacy, compliance, information security, quality, legal) and supporting a broad range of frameworks including NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO, NCQA, the BCBSA, etc. The incumbent is responsible for executing continuous monitoring of enterprise policies, standards, procedures/controls, business continuity/disaster recovery plans, etc. aimed to detect, prevent, and respond to risks across the enterprise risk taxonomy. Develops and oversees suite of multi-disciplinary risk monitoring reports. Applies risk decisioning criteria and exception handling criteria, and ensures risk treatment solutions are delivered according to contractual and other service-level obligations. Leads implementation and monitoring of corrective action measures based on internal or external audits/examinations. Seeks input on quality and effectiveness of own work while also takes responsibility to review the work of others for quality, adherence to standard practices and procedures, and to determine the realization of measurable risk treatment outcomes. May take on role project leadership roles for special assignments. Assists with mentoring less experienced team members. Has a proactive mindset and approach and feels comfortable working in a highly matrixed environment.

ESSENTIAL RESPONSIBILITIES

• Develops and executes a monitoring function intended to prevent, detect, and respond to risks, in partnership with business units and Senior Risk Partner (SRPs). Works with business units and other ERG constituents to prioritize monitoring activities.
• Develops programs and executes reporting and monitoring activities pertaining to known issues as well as threat and vulnerability scan reporting on applications, networks, operating systems, etc. to identify risk.
• Monitors current compliance environment including corporate policies and procedures and other rules and regulations through trend and other data analysis. Leads creation and adoption of ad-hoc and other reports pulling data from various sources and/or run system reports. Conducts complex analysis on reports and data sets to ensure systems and/or results meet expected thresholds/tolerances.
• Monitors Corrective Action / Remediation Plans, as necessary; reviews and analyzes results against expectations/benchmarks and communicates outcomes to management including Senior Risk Partners (SRPs). Applies relevant reporting and data analysis techniques to all work products.
• Executes against and provides ongoing feedback on risk treatment methodology in partnership with Risk Strategy (avoid, accept, transfer, mitigate). Collaborates with other areas of Risk Operations to prioritize, to upscale, and to improve risk intelligence and risk assessment activities.
• Researches, creates, and implements novel approaches to training and education on GRC process automation, reporting, and monitoring. Contributes to knowledge management repositories and other communities of practice.
• Other duties as assigned or requested.

EDUCATION

• Bachelor's Degree in Accounting, Business, Computer Science, Data Science, Finance, IT or related field

SUBSTITUTIONS

• 6 years of related and progressive experience in lieu of Bachelor's degree

PREFERRED

• None

EXPERIENCE

• 5 years with governance, risk, and compliance technology or related reporting and monitoring experience, preferably with the Archer GRC suite and/or in a healthcare or healthcare related industry, with increasing responsibility.
• 3 years of interacting with regulators, auditors, and oversight bodies

PREFERRED EXPERIENCE

• 3 years of report design, multi-disciplined data aggregation and analysis
• 3 years of continuous controls and process monitoring

LICENSES OR CERTIFICATIONS

• None

PREFERRED CERTIFICATIONS

• Certified Public Accountant (CPA)
• Certified Information Systems Auditor (CISA)
• Juris Doctorate (JD)
• Certified Information Privacy Professional (CIPP)

SKILLS

• Strong knowledge of business and technology processes, risk and control frameworks, and assessment methodologies, particularly as applied to healthcare (payer and provider) business processes
• Strong knowledge of how to leverage technologies to drive efficient and effective GRC processes across payor/provider industries
• Demonstrated resource and project planning capabilities, decision making skills, history of results-oriented delivery, and effective team work across a global and diverse team of staff
• Strong written and verbal communication skills for diverse audiences (senior management, board, peer, and team)
• Strong relationship building skills and ability to influence with and without authority in a matrixed organization
• Demonstrated leadership qualities with an ability to motivate and inspire a group of individuals to achieve superior results

Language (Other than English)

None

TRAVEL REQUIREMENT

0% - 25%

POSITION TYPE

Office-based

EEO STATEMENTS

Highmark Health and its affiliates prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on race, color, age, religion, sex, national origin, sexual orientation/gender identity or any other category protected by applicable federal, state or local law. Highmark Health and its affiliates take affirmative action to employ and advance in employment individuals without regard to race, color, age, religion, sex, national origin, sexual orientation/gender identity, protected veteran status or disability.

EEO IS THE LAW

Equal Opportunity Employer Minorities/Women/Protected Veterans/Disabled/Sexual Orientation/Gender Identity (https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf)