Under general supervision the Senior Information Security Analyst is responsible for the development, implementation and management of all activities related to HPSJ’s Information Security Governance, Risk and Compliance Programs that are used to safeguard HPSJ’s systems and data (ePHI). Work is varied and complex, and requires a moderate degree of discretion and independent judgment.
Essential Functions
- Proactively monitors the threat landscape and current controls to evaluate the effectiveness of the security tools and works with internal and external stakeholders to implement appropriate safeguards and controls.
- Implements upgrades, patches, and other modifications required to keep the tools up-to-date to guard against Cyber-attacks.
- Monitors server logs, firewall logs, intrusion detection and prevention logs, and network traffic (wired & wireless) for unusual or suspicious activity, interprets and makes recommendations for resolution.
- Performs risk assessments of internal and external applications/solutions to determine their adherence to security controls, HPSJ’s policies, standards and industry best practices, and maintains ongoing safeguards and access controls.
- Maintains enterprise information security policies, technical standards, guidelines, and procedures necessary to support information security in compliance with established company policies, regulatory requirements, and generally accepted information security controls.
- Makes recommendations on complex or ambiguous IT security administration issues, coordinating with users to determine requirements, and ensuring system improvements are successfully implemented and monitored, finding ways to increase efficiency.
- Works with the IT Operation team to develop a security strategy for enterprise security architecture and the implementation of appropriate safeguards and controls.
- Identifies and implements infrastructure security solutions which include both technologies and processes.
- Assesses current and planned applications and systems, identifying security protection issues and proactively identifying and modifying controls to protect against sophisticated cyber-attacks.
- Collaborates across the organization and with external parties to remediate security gaps.
- Contributes to the development and maintenance of information security strategy and architecture.
- Communicates security risks and solutions to business partners and IT staff as needed.
Required Skills
- Produces work that is accurate and complete.
- Produces the appropriate amount of work.
- Actively learns through experimentation when tackling new problems, using both successes and failures to learn.
- Rebounds from setbacks and adversity when facing difficult situations.
- Knows the most effective and efficient process to get things done, with a focus on continuous improvement.
- Demonstrated ability to design secure systems that are also HIPAA compliant.
- Experience in IT auditing.
- Basic knowledge of threat landscape, security threat and vulnerability management, and security monitoring and analytics.
- Strong knowledge of a healthcare environment and how the business is affected by regulatory requirements.
- Strong customer service orientation.
- Interpersonal skills - interacts effectively with individuals both inside and outside of HPSJ; relates openly and comfortably with diverse groups of people.
- Basic leadership skills, including but not limited to the ability to influence without authority and motivate others.
- Strong knowledge of security/compliance for Information Technology.
- Previous working knowledge of project management experience is highly desired. Previous experience working in a similar healthcare setting.
- Basic knowledge in the functional areas of health care insurance (i.e. benefits, claims adjudication, member/ provider demographic data management, medical management, and finance.
- Strong knowledge of Windows systems, network and domain architecture.
- Strong analytical and problem-solving skills, with the ability to seek alternatives, new ideas, and/or approaches to problems, and develop and implement solutions.
- Strong collaboration skills with demonstrated ability to create and foster a collaborative work environment, and maintain effective, high performance teams.
- Ability to work independently and as part of the team.
- Strong oral and written communication skills, including the ability to effectively communicate with both business and technical users, and make presentations.
- Strong interpersonal skills, including the ability to maintain effective working relationships with individuals at all levels both inside and outside of HPSJ.
- Time management and organizational skills. Uses time effectively and efficiently. Values time. Concentrates his/her efforts on the more important priorities. Can attend to a broader range of activities. Meets deadlines.
- Basic knowledge of the principles of health care systems.
- Ability to treat confidential information with appropriate discretion.
- Ability to speak and be understood in English.
Required Experience
- Bachelor’s Degree in computer science, engineering, information systems, mathematics or closely related field; and
- At least 10 years working with and supporting business and/or technology users; and
- At least 5 years of experience in security administration experience in a large, complex environment
LICENSES, CERTIFICATIONS
Preferred
- Certified Information Systems Security Professional Certification (CISSP) required or equivalent security certification, such as HealthCare Information Security and Privacy practitioner (HCISSP), Certified Information Security Manager (CISM), Ethical Hacker certification