IT Risk Analyst's

The IT Risk Analyst will lead the team responsible for elicitation, analysis and documentation of systems and state operations and coordination and facilitation of meetings with Medicaid/CHIP Services (MCS) and IT stakeholders. The team will evaluate over 50 systems to complete the Information Security Program Plan, Information System Security Plans and associated Risk Assessments. The Worker will coordinate with IT and business areas to identify risks, confirm controls, and make recommendations for improvement. The Worker will be responsible for identifying system interdependencies and confirming classification of data in a HIPAA environment. The Worker may serve as team lead over analysts.

This job role will aide in analysis and documentation of systems necessary to complete the Information Security Program Plan and to conduct security risk assessments.

The IT Risk Analyst’s responsibilities include:

• Working with subject matter experts across the MCS system to collect and update business and system data.
• Gathering information on HHS data source systems which interface to MCS systems.
• Completing Information Security Program Plan, Information System Security Plans and associated Risk Assessments using HHS defined security tools to identify risks and confirm current controls.

• 4 years - Experience with the National Institute of Standards Technology (NIST) 800-37 Risk Management Framework and 800-53 Security controls.
• 4 years - Supporting various compliance audits including, PCI, SOC, HIPAA and ISO.
• 4 years - Data Privacy experience
• 3 years - Proven ability to work successfully with technical and non-technical groups, and manage multiple responsibilities
• 2 years - Writing Information System Security Plans
• Strong - Communication, analytical and interpersonal skills at all levels
• Strong - Ability to work on multiple projects or project assignments
• Degree - Bachelor’s degree in Computer Science, Systems Engineering or equivalent experience

Preferences:

• 3 years - Experience facilitating productive meetings to formulate business requirements and communicate stakeholder needs to technical staff
• Industry recognized certification such as CISSP, CISA, GCIH
• Knowledge of Medicaid and/or CHIP programs and policy
• 2 years - Working with Health and Human Services or other Medicaid centric organizations