Senior GRC Analyst: Security Risk & Compliance

Cottage Health; Santa Barbara (CA); On-site; USD 90,000 - 130,000; Full time

Job summary

Cottage Health is seeking a Governance Risk & Compliance Analyst Senior for its CH ITS Security department. The role will lead security governance, risk management, and compliance activities across Cottage Health, partnering with IT, business, and vendor stakeholders to identify risks and strengthen the organization’s security program.

The candidate will manage risk assessments, maintain the Security Risk Register, and support HIPAA, PCI, and other regulatory activities, while developing metrics

Qualifications

• Minimum: Bachelor's Degree in Computer Science or related field; or equivalent experience (8 years)
• Minimum: 3-5 years of IT audit, risk management, or information security compliance experience

Responsibilities

• Lead security governance, risk, and compliance initiatives across the organization.
• Conduct security risk assessments and manage the enterprise Security Risk Register.
• Support HIPAA, PCI, and other regulatory compliance activities.
• Assess third-party vendors and monitor compliance with security requirements.
• Develop security metrics and report risk and compliance status to leadership.
• Create and maintain security policies, standards, and governance processes.
• Recommend risk mitigation strategies and drive remediation efforts.

Skills

Governance & compliance

Risk assessment

Regulatory compliance

Security governance

Vendor risk management

Education

Bachelor's degree in computer science or related field

Tools

HIPAA frameworks

PCI frameworks

NIST / CIS controls

Job description

Cottage Health is seeking a Governance Risk & Compliance Analyst Senior for its CH ITS Security department. The role will lead security governance, risk management, and compliance activities across Cottage Health, partnering with IT, business, and vendor stakeholders to identify risks and strengthen the organization’s security program.

The candidate will manage risk assessments, maintain the Security Risk Register, and support HIPAA, PCI, and other regulatory activities, while developing metrics