Senior Security Compliance Analyst

About the role

The Senior Security Compliance Analyst plays a crucial role in supporting and enhancing OneStudyTeam’s security and compliance programs within the healthcare industry. Key responsibilities include leading and supporting customer security audits, preparing and coordinating ISO 27001 audits, ensuring compliance with various security frameworks, and driving continuous improvement in security governance.

Responsibilities

• Lead and support customer security audits, responding to security questionnaires and demonstrating compliance with security frameworks.
• Prepare, coordinate, and manage ISO 27001 audits, including evidence collection, control implementation, and auditor engagement.
• Ensure ongoing compliance with HIPAA, NIST CSF, and other regulatory requirements applicable to healthcare data security.
• Develop and maintain policies, procedures, and security documentation to meet regulatory and contractual obligations.
• Perform gap analyses and risk assessments to identify and remediate compliance risks.
• Manage and improve security governance frameworks, ensuring alignment with industry best practices and business objectives.
• Conduct third-party vendor risk assessments, ensuring compliance with security policies and contractual obligations.
• Maintain and monitor security controls, ensuring effectiveness and continuous improvement in alignment with security frameworks.
• Support security awareness training initiatives, ensuring employees understand compliance responsibilities.
• Stay current on ISO 27001, HIPAA, NIST 800-53, and other relevant standards, translating them into actionable security controls.
• Aid in defining security metrics and reporting on compliance status and risk posture to leadership.
• Work closely with legal, security, IT, and business teams to align compliance requirements with security operations.

Requirements

• Minimum Education: Bachelor's degree in Information Security, Computer Science, Risk Management, or related field (or equivalent experience).
• Minimum Experience: 8+ years of progressive experience in GRC, compliance, or security audit roles.
• Experience in healthcare or regulated industries strongly preferred.
• Certifications: ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CISA, HITRUST CCSFP, CRISC.
• Experience leading ISO 27001, SOC2, or HITRUST audits, including ISMS implementation and external audit coordination.
• Strong understanding of NIST CSF, SOC 2, GDPR, and other security frameworks.
• Hands-on experience with customer security audits, including responding to security questionnaires and managing security assessments.
• Ability to perform risk assessments, policy reviews, and compliance gap analyses.
• Strong written and verbal communication skills, with the ability to explain technical concepts to non-technical stakeholders.
• Detail-oriented with excellent organizational and project management skills.
• Ability to work independently and collaboratively in a remote environment.
• Familiarity with GRC tools (e.g., OneTrust, LogicGate, Archer, Vanta, Drata) is a plus.

Qualifications

• Minimum Education: Bachelor's degree in Information Security, Computer Science, Risk Management, or related field (or equivalent experience).
• Minimum Experience: 8+ years of progressive experience in GRC, compliance, or security audit roles.
• Experience in healthcare or regulated industries strongly preferred.
• Certifications: ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CISA, HITRUST CCSFP, CRISC.
• Experience leading ISO 27001, SOC2, or HITRUST audits, including ISMS implementation and external audit coordination.
• Strong understanding of NIST CSF, SOC 2, GDPR, and other security frameworks.
• Hands-on experience with customer security audits, including responding to security questionnaires and managing security assessments.
• Ability to perform risk assessments, policy reviews, and compliance gap analyses.
• Strong written and verbal communication skills, with the ability to explain technical concepts to non-technical stakeholders.
• Detail-oriented with excellent organizational and project management skills.
• Ability to work independently and collaboratively in a remote environment.
• Familiarity with GRC tools (e.g., OneTrust, LogicGate, Archer, Vanta, Drata) is a plus.

Skills

• Expertise in Governance, Risk, and Compliance (GRC).
• Experience in healthcare or regulated industries.
• ISO 27001 Lead Auditor/Implementer certification.
• CISSP, CISM, CISA, HITRUST CCSFP, CRISC certifications.
• Experience with NIST CSF, SOC 2, GDPR, and other security frameworks.
• Hands-on experience with customer security audits.
• Ability to perform risk assessments and policy reviews.
• Strong written and verbal communication skills.
• Detail-oriented with excellent organizational and project management skills.
• Familiarity with GRC tools.

Benefits

• Competitive salary range: $110,000 - $140,000 USD per year for full-time team members.
• Flexible working arrangements.
• Professional development opportunities.
• Health insurance benefits.
• Retirement savings plan.

Pay

$110,000 - $140,000 USD per year for full-time team members.

Schedule

Full-time position.