Information Security Risk Analyst

Be part of a multidisciplinary team built with compassion and the goal of Moving Health Forward for you and our patients. Work where you matter. A Brief OverviewAssists in risk identification, development, and evaluation of information technology security controls including risk mitigation strategies as they apply to both IT and business environments. Delivers and supports evaluation of control designs, evaluation of control operation, reporting of control deficiencies, and remediation strategies. Reviews current processes for improvements in control documentation & testing for effectiveness and efficiency. Also collects and monitors information on security alerts, control failures/unmitigated risks and remediation results to build compliance reports for IT and business management. Provides advisory services for IT controls to projects, teams, and audits by ensuring consistent control implementation through documented processes for identifying control requirements prior to their implementation into production IT environments.What you will do

• Actively participates in assessing and evaluating the current adequacy of the security strategy along with identifying and reporting on risks and controls in the IT and business environments.
• Assists with the planning, design, and coordination of business continuity/disaster recovery plans along with threats to the systems/organization, and calculating the impact of potential adverse events.
• Identifies, performs, and evaluates the current testing of controls while maintaining and improving the process for evaluation of IT controls through a combination of automated testing and interviewing.
• Identifies, analyzes and initiates changes in Information Security policies, procedures, guidelines and standards as needed to ensure overall compliance with federal, state, and local laws and regulations.
• Identifies and reviews current advances in all areas of information technology concerning vulnerabilities, security breaches or malicious attacks and current security risk areas for IT.
• Coordinates the planning, design, and implementation of legacy application record retention. This includes working with operational owners in evaluating and documenting the risks associated with proposed alternatives.
• Assists with internal technology teams on supporting internal and external IT audits. Assists with and performs internal security and risk assessments as requested by management. Audits and assessments must be continual, as the threat profiles change constantly.
• Coordinates implementation of processes and procedures to achieve industry accepted security audit certifications such as SOC.
• Assists with simulated emergency exercises as needed for security and business continuity related functions. Assists with Technology Intake Process in reviewing security aspects of vendor supplied products/service.
• Collects information on control failures/unmitigated risks, including a clear description of the risk and its likelihood along with remediation results to build compliance reports for IT and business management.

Essential QualificationsThe individual must be able to work the hours specified. To perform this job successfully, an individual must be able to perform each essential job function satisfactorily including having visual acuity adequate to perform position duties and the ability to communicate effectively with others, hear, understand and distinguish speech and other sounds. These requirements and those listed above are representative of the knowledge, skills, and abilities required to perform the essential job functions. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job functions, as long as the accommodations do not cause undue hardship to the employer.Preferred Education, License/Certification, or Work Experience:

• Bachelor’s in related area
• Certified Information Systems Auditor (CISA) - ISACA
• Certified Information Systems Security Professional (CISSP) - International Information System Security Certification Consortium (ISC2)
• 4-6 years Related experience in IT, project management, compliance or security areas

Expectations and Standards

• Commitment to the daily application of Avera’s mission, vision, core values, and social principles to serve patients, their families, and our community.
• Promote Avera’s values of compassion, hospitality, and stewardship.
• Uphold Avera’s standards of Communication, Attitude, Responsiveness, and Engagement (CARE) with enthusiasm and sincerity.
• Maintain confidentiality.
• Work effectively in a team environment, coordinating work flow with other team members and ensuring a productive and efficient environment.
• Comply with safety principles, laws, regulations, and standards associated with, but not limited to, CMS, The Joint Commission, DHHS, and OSHA if applicable., Adverse Events, Analysis Skills, Auditing, CISA - Certified Information Systems Auditor, CISSP - Certified Information Systems Security Professional, Communication Skills, Computer Hacking, Computer Security, Design Evaluation, Disaster Recovery, Document Management, Documentation, External Audit, Federal Laws and Regulations, ISACA (Information Systems Audit and Control Association), Information Technology & Information Systems, Information Technology/Systems Audit, Information/Data Security (InfoSec), Internal Audit, International Information Systems Security Certification Consortium (ISC)2, Maintain Compliance, Operational Audit, Process Improvement, Process Management, Production Systems, Project/Program Management, Regulations, Risk, Risk Analysis, Risk Management, Safety Compliance, Security Analysis, Security Attacks, Security Auditing, Security Monitoring, State Laws and Regulations, Team Player, Technology Analysis, Test Automation, Testing

Avera is proud to offer a wide range of benefits to qualifying part-time and full-time employees. We support you with opportunities to help live balanced, healthy lives. Benefits are designed to meet needs of today and into the future.

• PTO available day 1 for eligible hires.
• Up to 5% employer matching contribution for retirement
• Career development guided by hands-on training and mentorship