Senior Security Risk & Compliance Analyst in at Abarca Health

What you'll do

In a few words… Abarca is igniting a revolution in healthcare. We built our company on the belief that with smarter technology we are redefining pharmacy benefits, but this is just the beginning…

The Senior Security Risk and Compliance Analyst oversees all Risk, Audit, Legal, and Compliance related efforts as they pertain to Information Systems and Security and perform any preparatory activities prior to any type of Audit, Legal, Compliance and Risk Associated events as well as remediation activities following such events. You’ll be responsible to schedule and execute preparation activities to make sure the Security Program covers all aspects and expectations from internal as well as external audits and security related assessments.

The fundamentals for the job...

• Oversee creating and reviewing all Security related policies and procedures in a constant pursuit of incorporating corporate Risks, Audit, Legal, and Compliance requirements into the Information Security Program.
• Contribute to the implementation and continuous improvement of security GRC processes.
• Support, configure, test, implement, and maintain the GRC processes in the applicable GRC product.
• Operationalize and manage the awareness and adoption of GRC processes.
• Track remediation and relevant metrics to help communicate status, demonstrate progress, and build awareness of GRC processes.
• Collaborate with security compliance team members to design, implement, and manage regulatory and compliance program requirements in the GRC product.
• Contribute to the strategy and execution of the overall security governance and risk management program.
• Cultivate relationships with security, engineering, legal, internal audit, and business stakeholders to strengthen security governance and risk management.
• Lead and manage the information security risk assessments and execute internal audits to ensure IT Controls are being followed identifying any gaps before formal audits detect them.
• Lead the vulnerability assessment efforts and establish baseline monitoring thresholds for the company.
• Provide support for the patch and vulnerability management efforts, which may include periodic vulnerability scans as well as patch package creation for deployment by the Infrastructure Team.
• Lead and manage the third-party risk management (TPRM)/Supply Chain Risk Management (SCRM) program with focus on ensuring all third-parties maintain at least the same level of security and controls.
• Lead and manage the response to third-party security questionnaires.
• Provide Security reporting & KPI’s on Infrastructure/Operations Security components.
• Roll up operational level data into organizational level risk information.
• Evaluate security alerts and incidents and develop and implement plans to reduce their risk to the organization.
• Support and be the Security liaison for the company’s SOC efforts.
• Define, implement, maintain, and enforce corporate security and compliance policies.
• Audit access rights to ensure compliance with policy.
• Develop security and compliance requirements for organizational initiatives.
• Research security & compliance standards and keep policies and procedures up to date.
• Assist with the execution and enforcement of the IT Change Management process.
• Participate in and be the liaison for the Compliance, Security, and Risk Management (CSRM) Committee.

What we expect of you

The bold requirements...

• Bachelor’s Degree or Master’s Degree in Information Technology, Computer Science, or related field (In lieu of a degree, equivalent, relevant work experience may be considered.)
• 6+ years of experience in Information Security and Healthcare Compliance•Experience in Internal Controls, Security Policies and Procedures, Action Planning, and Execution.
• Experience with the selection, implementation, and maintenance of security and compliance tools such as SIEM, vulnerability scanning, or identity management solutions.
• Experience qualitative and quantitative risk management approaches and processes, including proven implementation experience.
• Experience with security practices and controls applied to address security risks, applying frameworks (security, risk, and control) such as NIST, COBIT, and ISO.
• Experience with principles behind IT Compliance and Security
• Experience with Compliance and Local Regulations as well as Federal Regulations that pertain to the Healthcare Industry.
• Excellent oral and written communication skills.
• We are proud to offer a flexible hybrid work model which will require certain on-site work-days (Puerto Rico Location Only)
• This position requires availability to work in a specified time zone or working schedule, accommodating the business needs of our clients and team members.
• This position may require availability for on-call hours, including evenings, weekends, and holidays, to promptly address emergent issues or provide necessary support as dictated by operational demands (if applicable).

Nice to haves...

• One or more of the following certifications (e.g. CISSP, CRISC, CISA, CERP, FAIR/Open FAIR, CGEIT, etc.)
• Experience Healthcare, Pharmacy, and Pharmacy Benefit Management industries, Medicare Part D, and CMS regulations
• Experience with GRC products (e.g., RSA-Archer, RisKonnect, Metric Stream, ServiceNow GRC, etc.)
• Experience leading regulatory compliance and understanding of information technology service management frameworks such as ITIL, ISO 20000

Physical Requirements

• Must be able to access and navigate each department at the organization’s facilities.
• Sedentary work that primarily involves sitting/standing.

At Abarca we value and celebrate diversity. Diversity, equity, inclusion, and belonging are guiding principles of Abarca and ensure Abarca’s workforce reflects the communities it serves. We are proud to provide equal employment opportunities to all employees and applicants for employment and prohibit discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, medical condition, genetic information, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.

Abarca Health LLC is an equal employment opportunity employer and participates in E-Verify. Abarca Health LLC does not sponsor employment visas at this time.

The above description is not intended to limit the scope of the job or to exclude other duties not mentioned. It is not a final set of specifications for the position. It’s simply meant to give readers an idea of what the role entails.