Security & Risk Analyst — Vendor & Compliance Lead

HealtheConnections; City of Syracuse (NY); On-site; USD 70,000 - 85,000; Full time

Job summary

HealtheConnections, a national leader in health information exchange, seeks an Information Security and Risk Analyst to strengthen our enterprise security and compliance program.

You’ll coordinate vendor security reviews, support regulatory compliance, maintain risk documentation, and track remediation to keep us audit-ready. You’ll collaborate with internal teams, business partners, and vendors to improve security while delivering tangible protection for health information across New York State.

Qualifications

• 3+ years of experience in Information Security, IT Risk, Compliance, Audit, or related field.
• Working knowledge of HIPAA and healthcare security requirements.
• Familiarity with governance frameworks such as NIST CSF, HITRUST, OHIP or similar.
• Experience supporting vendor risk assessments, audit activities, security documentation, or remediation tracking.
• Strong organizational and project management skills.
• Proven track record managing a vendor relationship.
• Security certifications (Security+, CySA+, CISA, CRISC, or similar) or progress toward certification.

Responsibilities

• Conduct third-party security reviews and risk assessments and document findings.
• Review vulnerability scans and penetration tests and track remediation.
• Maintain security risk registers and POAMs with remediation actions.
• Maintain HITRUST, OHIP and other security requirements.
• Develop and update security policies, procedures, and documentation.
• Compile security metrics and reports for stakeholders.
• Support security awareness by preparing reminders and updates.

Skills

Information Security

IT Risk

Compliance

Audit

Vendor Management

Project Management

Security Certifications

Tools

NIST CSF

HITRUST

OHIP

Job description

HealtheConnections, a national leader in health information exchange, seeks an Information Security and Risk Analyst to strengthen our enterprise security and compliance program.

You’ll coordinate vendor security reviews, support regulatory compliance, maintain risk documentation, and track remediation to keep us audit-ready. You’ll collaborate with internal teams, business partners, and vendors to improve security while delivering tangible protection for health information across New York State.