Senior Cybersecurity GRC Analyst: NIST/HIPAA Compliance

Penn Medicine; Philadelphia (Philadelphia County); Hybrid; USD 90,000 - 130,000; Full time

Job description

Description

Penn Medicine is dedicated to our tripartite mission of providing the highest level of care to patients, conducting innovative research, and educating future leaders in the field of medicine. Working for this leading academic medical center means collaboration with top clinical, technical and business professionals across all disciplines.

Today at Penn Medicine, someone will make a breakthrough. Someone will heal a heart, deliver hopeful news, and give comfort and reassurance. Our employees shape our future each day. Are you living your life's work?

Entity: Corporate Services

Department: CyberSecurity GRC

Location: 3535 Market Street/hybrid

Summary:

The Cybersecurity GRC Sr. Research Compliance Analyst supports the organization's cybersecurity compliance program by assessing, monitoring, and ensuring adherence to NIST Special Publications requirements for systems that process, store, and/or transmit sensitive information.

The role contributes to internal and external audits, regulatory assessments, and ongoing compliance activities by performing control testing, validating evidence, identifying gaps, and supporting remediation efforts. The senior analyst partners with technical and business stakeholders to ensure controls are effectively implemented and maintained in the secure research enclave, aligning with Office of Research Services and Office of the Vice Provost for Research compliance initiatives.

Responsibilities:

• Primarily conduct assessments against NIST SP 800 171 control families to evaluate compliance for systems handling Controlled Unclassified Information (CUI). Additionally conduct assessments relative to HIPAA, NIST SP 800-53, FISMA, and other standards as necessary.


• Perform control design and operating effectiveness testing, including evidence collection, validation, and documentation.


• Support internal audits, external assessments, and regulatory reviews by preparing documentation, coordinating responses, and participating in walkthroughs and interviews.


• Identify compliance gaps and deficiencies, assess associated risk, and collaborate with system owners and stakeholders to develop and track remediation plans.


• Maintain compliance artifacts including System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), control narratives, and assessment results.


• Interpret NIST 800 171 and other framework requirements and provide guidance to technical and business teams on control implementation and documentation expectations.


• Support continuous monitoring activities to ensure sustained compliance with NIST 800 171 and other framework requirements over time.


• Perform other duties as assigned to support the Cybersecurity Governance Risk and Compliance team as directed in accordance with Penn Medicine policies, procedures, and values.


• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures


• Other duties as assigned to support the unit, department, entity, and health system organization

Education or Equivalent Experience:

• Bachelor's degree is required.


• 6+ years of IT and cybersecurity experience is required.


• 3+ years of auditing, assessing, and/or ensuring compliance with published framework(s) is required.

We believe that the best care for our patients starts with the best care for our employees. Our employee benefits programs help our employees get healthy and stay healthy. We offer a comprehensive compensation and benefits program that includes one of the finest prepaid tuition assistance programs in the region. Penn Medicine employees are actively engaged and committed to our mission. Together we will continue to make medical advances that help people live longer, healthier lives.

Live Your Life's Work

We are an Equal Opportunity employer. Candidates are considered for employment without regard to race, ethnicity, color, sex, sexual orientation, gender identity, religion, national origin, ancestry, age, disability, marital status, familial status, genetic information, domestic or sexual violence victim status, citizenship status, military status, status as a protected veteran or any other status protected by applicable law.