Remote InfoSec Risk Analyst – Intermediate (HIPAA/NIST)

UChicago Medicine; Illinois; Hybrid; USD 90,000 - 130,000; Full time

Benefits offered by this job

Flexible work options

Job summary

UChicago Medicine is seeking an Information Security Risk Analyst – Intermediate to support the Governance, Risk and Compliance (GRC) team. This role is primarily remote with on-site requirements as needed for the greater Chicagoland area.

Responsibilities include conducting risk analyses on IT assets, ensuring HIPAA and NIST alignment, maintaining risk registers, and driving remediation efforts with key stakeholders across IT, Legal, Compliance, and Clinical Operations.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Engineering, IT, or related field.
• Master’s degree preferred.
• 3+ years in cybersecurity, information security risk management, or audits in healthcare preferred.
• Strong understanding of HIPAA, NIST, and healthcare regulations.

Responsibilities

• Lead and conduct comprehensive information security risk analysis for IT assets, applications, processes, medical devices and third-party vendors.
• Evaluate threats and vulnerabilities affecting ePHI and sensitive information, ensuring HIPAA/NIST alignment.
• Lead and manage risk management initiatives, maintain risk register and scoring methodology.
• Oversee CAPs, penetration testing results, audit findings, and risk treatment outcomes.
• Collaborate with IT partners and stakeholders to prioritize, implement, and track remediation efforts.
• Monitor regulatory changes and industry threats to identify emerging risks and mitigation strategies.
• Contribute to risk reporting and governance reviews, including executive dashboards.

Skills

Risk analysis

Information security

Regulatory compliance

Communication

Stakeholder collaboration

Project management

Education

Bachelor's degree in information security or related field

Master's degree preferred

Tools

Risk management platforms

Audit tools

Job description

UChicago Medicine is seeking an Information Security Risk Analyst – Intermediate to support the Governance, Risk and Compliance (GRC) team. This role is primarily remote with on-site requirements as needed for the greater Chicagoland area.

Responsibilities include conducting risk analyses on IT assets, ensuring HIPAA and NIST alignment, maintaining risk registers, and driving remediation efforts with key stakeholders across IT, Legal, Compliance, and Clinical Operations.