Senior GRC Analyst: Risk & Compliance Leader

Cone Health; Greensboro (NC); On-site; USD 90,000 - 130,000; Full time

Job summary

Cone Health is seeking a Senior GRC Analyst to collaborate with process owners, internal and external auditors, and stakeholders to review, monitor, and resolve cybersecurity risk. You will support HITRUST, HIPAA and NIST CSF audits and attestations, respond to assessments, and ensure compliance with SOC2, ISO 27001, PCI-DSS, SOX, and other GRC activities.

The role involves implementing internal and external assessments, managing the lifecycle of audits, and contributing to the IT compliance

Qualifications

• Bachelor's degree or equivalent experience is required.
• 7+ years of experience is required.
• CISM certification is required.

Responsibilities

• Lead the execution and reporting of outcomes derived from Third Party Risk Assessments.
• Manage the completion of risk and vulnerability assessments, validation testing, compliance reviews, and audits in accordance with NIST and HITRUST standards.
• Manage and monitor a central repository for all security risks and audit evidence.
• Maintain security standards, policies, and practices on an annual basis to meet organizational and regulatory requirements.
• Manage a security awareness training program to educate associates about security compliance standards, risk management practices, and ethical behavior.
• Collaborate with legal and compliance teams to ensure policies and security controls align with regulatory requirements.
• Conduct internal audits to assess the effectiveness of security controls and identify areas for improvement.
• Performs other duties as assigned.

Skills

Risk assessments

Audits

Security controls

Compliance programs

Security awareness

Education

Bachelor's degree or equivalent experience

Job description

Cone Health is seeking a Senior GRC Analyst to collaborate with process owners, internal and external auditors, and stakeholders to review, monitor, and resolve cybersecurity risk. You will support HITRUST, HIPAA and NIST CSF audits and attestations, respond to assessments, and ensure compliance with SOC2, ISO 27001, PCI-DSS, SOX, and other GRC activities.

The role involves implementing internal and external assessments, managing the lifecycle of audits, and contributing to the IT compliance