Third Party Risk Analyst

Fortified Health Security; Exton (PA); On-site; USD 70,000 - 90,000; Full time

Job summary

Fortified Health Security is seeking a Third Party Risk Analyst to ensure successful processing and delivery of TPRM assessments for clients. The role applies information security frameworks to identify third-party risk, with a focus on protecting patient health information and regulatory compliance.

The position requires knowledge of HIPAA, HITECH, and NIST CSF 2.0, plus experience in producing risk reports and guiding clients on remediation and governance tasks.

Qualifications

• Bachelor's degree or equivalent education/experience.
• 1+ years IT support in enterprise environment.
• Knowledge of HITRUST CSF, NIST CSF 2.0, ISO 27001 and SOC 2 Type 2.
• HIPAA Security Rule familiarity preferred.
• Experience in healthcare information security highly preferred.

Responsibilities

• Ensure timely delivery of TPRM assessment reports and other deliverables.
• Create reports reflecting findings for technical and executive audiences.
• Communicate with clients and third parties regarding TPRM services and support.
• Directly manage and oversee the delivery of TPRM services for assigned clients.
• Maintain knowledge of healthcare information security laws/regulations and industry frameworks (HIPAA, HITECH, NIST CSF 2.0).
• Contribute to maintenance of client-specific and internal TPRM policies and procedures.

Skills

Analytical mindset

Detail oriented

Communication skills

Team player

Self-driven

Problem solving

Presentation skills

Security concepts

Network concepts

Education

Bachelor's degree or equivalent

1+ years IT support / security experience

HITRUST CSF / NIST CSF 2.0 / ISO 27001 / SOC 2 Type 2

HIPAA Security Rule knowledge

Healthcare information security experience

Job description

Under the general direction of the Director of Risk and Governance Services, the Third Party Risk Analyst is responsible for ensuring that Third-Party Risk Management (TPRM) assessments are successfully and consistently processed and delivered to clients. This position requires a moderate working knowledge of information security frameworks and the application of these frameworks to identify instances of risk in relation to third parties. The role includes responsibilities in product/service evaluation, risk identification and remediation, report writing, and client consulting on all matters related to the protection and regulatory compliance of patient health information.

Essential Job Functions

The following duties are normal for this position. The omission of specific statements of duties does not exclude them from being expected of this position if the work is similar, related, or a logical assignment for this position. Other duties may be required.

• Ensure timely delivery of TPRM vendor assessment reports, and other TPRM service deliverables as required
• Create reports which reflect assessment findings and recommendations in both technical and executive-level formats
• Communicate with clients and third parties regarding TPRM service support and delivery
• Directly manage and oversee the delivery of TPRM services for clients the Third Party Risk Analyst is dedicated to supporting
• Maintain a working knowledge of healthcare information security and privacy laws and regulations alongside industry frameworks including, but not limited to: HIPAA, HITECH, and the NIST CSF 2.0
• Maintain a working knowledge of TPRM best practices
• Contribute to the maintenance of client specific and internally managed TPRM policies and standard operating procedures

Knowledge & Skills

Education & Experience

• Bachelor's degree from a four-year college or university or combination of education and experience
• 1+ years’ experience in all or most of the following:
• IT support or help desk, preferably in an enterprise environment
• Information security frameworks and/or standards such as the HITRUST CSF, the NIST CSF 2.0, ISO 27001, and SOC 2 Type 2
• Use and application of the HIPAA Security Rule in day-to-day responsibilities preferred
• Information security experience within the healthcare industry highly preferred

Special Skills & Knowledge

• Ability to be flexible and manage tasks as priorities change based on client needs
• Self-driven individual who requires minimal direct supervision from supervisors when completing known, repeatable tasks
• Analytical mindset which enables the individual to efficiently and accurately gain an understanding of how a newly presented product or service functions, supporting the creation and delivery of assessment reports and findings
• Exceptional problem-solving abilities alongside a desire to continually learn new concepts related to the field
• Detail and results oriented, skilled at both planning and hands-on execution
• Ability to excel in a team-oriented, collaborative office environment
• Excellent written, verbal, and presentation skills
• Intermediate understanding of security concepts and how they should be applied to a system’s architecture and workflow
• Intermediate understanding of network infrastructure and security concepts
• Preferred certifications: Network+, Security+, HITRUST-related certificates

Requirements

Supervisory Responsibility

• Third-party risk management services delivered within the Risk and Governance Services business unit

Working Conditions & Travel Requirements

• Travel as needed.
• In Office in Exton, PA Office

Fortified Health Security is an Equal Opportunity Employer. In compliance with the Americans with Disabilities Act, Fortified Health Security will provide reasonable accommodations to qualified individuals with disabilities. If a reasonable accommodation is needed to perform this position, you need to inform Fortified Health Security People and Culture Team of such request. Signatures below indicate the receipt and review of this job description by the associate assigned to the position and the People and Culture Team.