InfoSec GRC Analyst (32931)

ExamWorks is looking for an experienced GRC Analyst to join the team! This role is 100% remote and can be located anywhere in the United States.

Responsibilities

• Assessment, implementation, management, and documentation of security controls in support of ExamWorks and subsidiaries’ information security strategy and compliance requirements.
• Advocate an effective security program, including system‑wide security analysis, intrusion and vulnerability detection, standards and testing, risk assessment, awareness and education, and development of policies, standards, and procedures.
• Facilitate HITRUST and SOC 2 audit engagements, data/artifact collection, exception remediation, and monitoring.
• Respond to client assessments and RFPs, conduct vendor risk assessments and reassessments.
• Conduct or participate in cross‑training sessions with the IT Security team on the management and configuration of security tools and technical controls.

Qualifications

• College degree in Computer Science or a related field.
• 5 years of experience in IT security, risk management, compliance, and audit.
• Subject‑matter‑expert knowledge of compliance and security frameworks such as SOX, PCI, SOC, NIST, ISO 27001, HITRUST, HIPAA, and HITECH.
• Experience coordinating compliance audit processes and IT security risk‑assessment programs.
• Ability to articulate general IT security policies, processes, and technical controls.
• Capability to provide insights into controls design, implementation, and deficiency remediation.
• Excellent written and verbal communication skills.

Schedule

Regular Monday – Friday standard business hours.

Benefits

• Medical, vision, and dental insurance
• Paid time off
• 401(k) retirement plan

Who We Are

ExamWorks is a leading provider of innovative healthcare services, including independent medical examinations, peer reviews, bill reviews, Medicare compliance, case management, record retrieval, document management, and related services. Our clients include property and casualty insurance carriers, law firms, third‑party claim administrators, and government agencies that use independent services to confirm the veracity of claims by sick or injured individuals under automotive, disability, liability, and workers’ compensation insurance coverages.