Senior IT Security & GRC Analyst

Capital Health Screening Centre; Lawrenceville (NJ); On-site; USD 108,000 - 141,000; Full time

Benefits offered by this job

Medical Plan

Dental Plan

Vision Plan

FSA

Job summary

Capital Health is seeking an IT Security Analyst II to independently own core information security programs, including third-party risk management, phishing simulation, and application security assessments. The role builds on the IT Security Analyst I foundation and leads end-to-end programs, aligning risk to business needs and regulatory requirements.

The candidate will draft and maintain security policies, train staff, and report on security metrics while mentoring junior team members in a

Qualifications

• Bachelor's degree in a relevant field or equivalent experience.
• Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles.
• Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks.
• CompTIA Security+ required.

Responsibilities

• Owns and manages the third-party risk management (TPRM) program end-to-end, including vendor classification logic, risk scoring methodology, intake routing/workflows, assessment questionnaires, and reassessment tracking.
• Independently drives vendor risk assessments from initial outreach through closure, including follow-up with unresponsive vendors, review of vendor-submitted documentation, and escalation of high-risk or unresolved vendor relationships to leadership.
• Administers the organization's enterprise phishing simulation program, including campaign design and scheduling, execution, data collection, results analysis, and reporting of metrics and trends to leadership.
• Performs Application Security Assessments for new and existing software, evaluating security posture and providing risk-based recommendations to stakeholders.
• Owns and manages the software request and review process, evaluating new software and vendor tools for security risk prior to approval and onboarding.
• Provides broader support to overall GRC program strategy and planning, partnering with the IT Manager on initiatives such as multi-campaign phishing simulation roadmaps, TPRM process improvements, and team capacity/workload planning for a small, high-throughput GRC team.
• Researches, drafts, and maintains information security policies, standards, procedures, and performs detailed policy reviews.
• Develops and maintains security awareness training content for staff and management audiences, including designing and updating training presentation materials with current statistics and emerging threat topics.
• Coordinates examinations by qualified security assessors for regulations and frameworks such as HIPAA and NIST, working with control owners and external assessors to ensure evidence requests are completed timely and accurately.
• Monitors security alerts, analyzes incidents, and contributes to incident response activities in coordination with the Security Operations team and IT Manager.
• Maintains comprehensive documentation of TPRM activities, vendor assessments, security awareness training and phishing simulation activities, and policy review work.
• Generates and analyzes regular reports on information security metrics for management review, identifying trends and improvement opportunities.
• Stays informed of industry best practices, emerging threats, and advancements in cybersecurity, and pursues relevant certifications and training to enhance expertise.

Skills

NIST CSF

HIPAA

CompTIA Security+

Vendor risk assessments

Phishing simulation

Policy development

Education

Bachelor's degree in a relevant field

Job description

Capital Health is seeking an IT Security Analyst II to independently own core information security programs, including third-party risk management, phishing simulation, and application security assessments. The role builds on the IT Security Analyst I foundation and leads end-to-end programs, aligning risk to business needs and regulatory requirements.

The candidate will draft and maintain security policies, train staff, and report on security metrics while mentoring junior team members in a