Senior Risk & Compliance Analyst - Third-Party Security

Highmark Health; Pittsburgh (Allegheny County); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Highmark Health seeks an experienced risk and compliance professional to lead third-party risk management and oversee assessments across NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS and JCAHO standards. This role partners with procurement, legal and business units to negotiate security and privacy requirements and ensure controls align with enterprise risk appetite.

The incumbent will guide cross-functional teams, influence stakeholders in a matrixed environment, and maximize risk-informed decisions

Qualifications

• Bachelor's degree in relevant field; substitutions 6 years of related experience in lieu of degree.
• 5 years in Audit and Compliance, including 3 years of Business Process Design and 3 years of Project Management.
• Certifications such as CPA, CISA, CIPP, CISSP preferred.

Responsibilities

• Plan and conduct risk assessments across frameworks (NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO).
• Prepare management reports and review work for audit quality.
• Lead development of risk assurance plans and coordinate with business owners.
• Collaborate with Information Security, Privacy, Procurement, Audit, Compliance and other teams.
• Communicate assessment results to stakeholders and provide guidance.

Skills

Regulatory frameworks

Risk assessment

Vendor management

Stakeholder management

Contract negotiations

Communication skills

Leadership

Analytical thinking

Education

Bachelor's degree

Master's degree

Tools

RSA Archer

Job description

Highmark Health seeks an experienced risk and compliance professional to lead third-party risk management and oversee assessments across NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS and JCAHO standards. This role partners with procurement, legal and business units to negotiate security and privacy requirements and ensure controls align with enterprise risk appetite.

The incumbent will guide cross-functional teams, influence stakeholders in a matrixed environment, and maximize risk-informed decisions