Information Security and Risk Analyst

Who: HealtheConnections, a respected national leader in providing health information exchange (HIE) services for NYS-based organizations. What: We're looking for a Information Security and Risk Analyst to help strengthen our enterprise security and compliance program. This role is ideal for someone with experience in information security, governance, risk, compliance, or IT operations who enjoys building processes, improving security practices, and collaborating across teams to protect sensitive healthcare information. Why: Every day, HealtheConnections supports the secure exchange of healthcare information used by providers and organizations across New York State. You'll help safeguard that information by coordinating vendor security reviews, supporting regulatory compliance, maintaining risk documentation, tracking remediation efforts, and helping ensure we're always audit-ready. You'll work with internal teams, business partners, and vendors to strengthen security processes while supporting a collaborative, high-performing organization whose work has a direct impact on healthcare throughout our communities. We're looking for someone who is organized, proactive, enjoys solving problems, and takes pride in creating well-documented, repeatable processes. Talk to us to see if this is a fit for you! Primary Responsibilities: Conduct third-party security reviews and risk assessments using vendor documentation and/or discussions; document findings, coordinate remediation with technical teams, track issues through resolution, and report results to management. Review vulnerability scans and penetration test results; work with vendors, security partners, and service providers to investigate security concerns, gather information, track open issues and remediation thereof, and ensure third parties meet organizational security requirements. Maintain security risk registers and other documentation, including Plans of Action and Milestones (POA&Ms) by documenting identified gaps, assigning remediation actions, tracking deadlines, and following up on outstanding items. Maintain security, compliance, and requirements for HITRUST, OHIP, and other applicable security initatives. Develop and update security policies, procedures, and operational documentation to reflect current security practices, compliance requirements (e.g., HITRUST), and changes to organizational processes. Compile security metrics, dashboards, and reports to communicate risk trends, outstanding vulnerabilities, remediation progress, and compliance status to internal stakeholders. Support security awareness and communication efforts by preparing security reminders, and distributing updates on security practices, policies, and emerging risks. What this role is and is not: This role is focused on the day-to-day running of the security program. You’ll help us understand where security risks exist, ensure vendors meet our security requirements, support audits and compliance efforts, and track issues through resolution. You’ll work closely with technical teams, but you won’t be the person responsible for hands-on IT troubleshooting, networking, or configuring security tools. This is not an IT help desk or desktop support position. Troubleshooting hardware, software, or end-user issues alone does not prepare you for this role’s core responsibilities. Competencies & Experience: 3+ years of experience in Information Security, IT Risk, Compliance, Audit, or related field. Working knowledge of HIPAA and healthcare security requirements is strongly preferred. Familiarity with security frameworks such as NIST Cybersecurity Framework, HITRUST, OHIP or similar governance frameworks. Experience supporting vendor risk assessments, audit activities, security documentation, or remediation tracking. Strong organizational and project management skills, with the ability to prioritize competing demands and follow through on outstanding tasks. Proven success being the primary manager of a vendor relationship Security certifications (Security+, CySA+, CISA, CRISC, or similar) or progress toward certification are preferred. You’re a great fit for us if you’re good at… <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"