Information Security Risk and Governance Specialist, Consultant

The Technology and Data Trust Assurance Services team drives BSC technology and information security adherence to regulatory standards, as well as policies, standards, and controls development, with the goal of evaluating, directing and monitoring IT vendor performance, while safeguarding company assets and maintaining and securing the confidentiality, integrity, and availability of Blue Shield of California data . The Technology Risk and External Assurance program runs technology governance forums and manages technology risk from identification to risk consequence management for BSC. The Information Security Risk & Governance Specialist, Consultant will report to the Senior Manager, Technology Risk Assurance. In this role, you will be a key individual contributor to the Technology Risk and External Assurance team and Blue Shield’s overall strategy and goals by providing consistent, coordinated technology governance, information security oversight, AI governance, technology risk assessment, and risk reporting in partnership with leaders, stakeholders, and Stellarus.

Your Work

In this role, you will:

• Participate in technology risk governance activities (e.g., committees, presentation preparations, training and awareness, etc.)
• Develop and implement technology governance programs, including technical performance oversight, AI governance, and data exchange and third-party risk governance that will help BSC understand its inherent and residual risk exposure
• Assess AI tools, techniques, and procedures to enhance AI risk management capabilities throughout the company
• Implement strategic goals established by BSC leadership
• Be responsible for third-party security risk assessment activities ensuring Blue Shield’s data is stored, transmitted, and processed in a secure manner
• Enhance and conduct training and awareness activities to business teams and applicable third parties
• Partner with cross functional operational business partners including Customer Experience, Customer Care, Markets, Health Solutions and Enterprise Risk Management to operationalize and socialize the IT risk management framework and program and to identify shifts in the organization’s implicit risk appetite.
• Lead and support the development of reporting processes to communicate progress of in-flight initiatives, risks and planned initiatives to senior executives and stakeholders in other business units

Do you have experience in Regulatory compliance?, Do you have a Bachelor’s degree?, * Requires a bachelor’s degree or equivalent experience

• Requires at least 7 years of prior relevant experience
• Previous experience working in the healthcare, pharmaceutical, biotechnology or related services industry is required
• Knowledge of various information technology governance and control frameworks and industry standards such as COBIT, COSO, ITIL, PMBOK, AICPA SOC Trust Principles, and NIST is required
• Knowledge of Artificial Intelligence (AI) governance and monitoring practices is preferred
• Demonstrated experience as a governance, risk and compliance (GRC) expert is required
• Requires business acumen, strategic thinking, financial analytical skills, and decision-making skills
• Excellent communication and presentation skills at every level including executives is required
• Experience working with healthcare partners and vendor contracts and understanding of the key components of basic agreements and how legal terms impact business terms and vice versa is preferred.

As of January 2025, Blue Shield of California became a subsidiary of Ascendiun. Ascendiun is a nonprofit corporate entity that is the parent to a family of organizations including Blue Shield of California and its subsidiary, Blue Shield of California Promise Health Plan; Altais, a clinical services company; and Stellarus, a company designed to scale healthcare solutions. Together, these organizations are referred to as the Ascendiun Family of Companies.

At Blue Shield of California, our mission is to create a healthcare system worthy of our family and friends and sustainably affordable. We are transforming health care in a way that genuinely serves our nonprofit mission by lowering costs, improving quality, and enhancing the member and physician experience.

To achieve our mission, we foster an environment where all employees can thrive and contribute fully to address the needs of the various communities we serve. We are committed to creating and maintaining a supportive workplace that upholds our values and advances our goals.

Blue Shield is a U.S. News Best Company to work for, a Deloitte U.S. Best Managed Company and a Top 100 Inspiring Workplace. We were recognized by Fair360 as a Top Regional Company, and one of the 50 most community-minded companies in the United States by Points of Light. Here at Blue Shield, we strive to make a positive change across our industry and communities - join us!

Our Values:

• Honest. We hold ourselves to the highest ethical and integrity standards. We build trust by doing what we say we’re going to do and by acknowledging and correcting where we fall short.
• Human. We strive to listen and communicate effectively, showing empathy by understanding others’ perspectives.
• Courageous. We stand up for what we believe in and are committed to the hard work necessary to achieve our ambitious goals.

Our Workplace Model

We believe in fostering a workplace environment that balances purposeful in-person collaboration with flexibility - providing clear expectations while respecting the diverse needs of our workforce. Our workplace model is designed around intentional in-person interaction, collaboration, connection, creativity and flexibility:

• For most teams, this means coming into the office two days per week.
• Employees living more than 50 miles from an office location, out of state employees, and employees in certain member-facing roles should work with their manager to determine in-office time based on business need.
• For employees with medical conditions that may impact their ability to work in-office, we are committed to engaging in an interactive process and providing reasonable accommodations to ensure their work environment is conducive to their success and well-being.

The Company reserves the right to require more presence in the office based on business needs, and requirements are subject to change with periodic reviews.

Physical Requirements:

Office Environment - roles involving part to full time schedule in Office Environment. Based in our physical offices and work from home office/deskwork - Activity level: Sedentary, frequency most of work day.