Governance, Risk & Compliance Analyst; Third-Party Risk Analyst

recruit
22 is looking for a Governance, Risk & Compliance (GRC) Analyst to join one of our clients in the healthcare sector. The Governance, Risk & Compliance (GRC) Analyst plays a key role in supporting the organization's risk management strategy, with a focus on third-party risk. This role involves coordinating vendor assessments, supporting audit activities, and maintaining compliance with industry standards and regulatory frameworks.

The analyst will also contribute to the development and maintenance of GRC platforms and security policies.

• Support enterprise risk strategy by identifying, reporting, and managing remediation activities for key risks.
• Coordinate third-party vendor risk assessments, conduct gap analyses, and maintain associated controls and metrics.
• Assist with internal and external audit processes, including SOC 2, HIPAA, and HITRUST.
• Develop and implement security policies, procedures, and reporting mechanisms.
• Design, deploy, and maintain the GRC platform to support risk and compliance initiatives.
• Lead third-party risk management efforts and contribute to incident response and business continuity/disaster recovery (BC/DR) planning.
• Respond to security-related inquiries, draft technical reports, and stay informed on evolving security regulations and best practices.

• University degree in Information Security, Computer Science, Information Technology, or equivalent experience.
• 2 or more years of experience in Information Security, IT Security, or IT Risk Management.
• Familiarity with GRC platforms and cybersecurity frameworks such as HIPAA, PCI DSS, and NIST 800.
• Strong communication, organizational, and project management skills.
• Ability to manage multiple tasks independently in a fast-paced environment.

• Bachelor's degree in a relevant field.
• 5 or more years of experience in risk management or cybersecurity.
• Experience working in healthcare environments and with frameworks such as ISO/IEC 27001/27002.
• Relevant certifications such as CISM, CISA, CRISC, or CGEIT.

No 3rd party vendor and no sponsorship offered at this time