Information Security Analyst
SimplePractice is the future of practice management. We’re at the forefront of making it simple for clinicians to run and grow their practices. We’ve built the highest-rated practice management software and we’re on track to become the most-used product in our industry.
We are looking for an information security analyst who will implement innovative information security controls that mitigate SimplePractice’s risk, empower innovation and show continued dedication to security for both our customers and their clients.
As Information Security Analyst at SimplePractice, you will:
- Understand technical implementation details necessary to identify and assess security risks and recommend mitigating controls
- Participate in the development and oversight of required corrective action plans relating to security compliance issues
- Support business relationships with the internal and external security auditors and regulators
- Identify, research and evaluate new compliance requirements and ensure they are incorporated into SimplePractice’s security policy framework
- Support the communication of policies, procedures, and plans to internal stakeholders regarding security and compliance best practices around applicable laws, regulations and controls
- Support the identification, validation and remediation of information technology controls
- Be responsible for Data Security Standards (HITRUST and PCI), regulations governing personally identifiable information (PII) and other applicable regulatory compliance frameworks
- Partner with internal teams to ensure successful security programs that align with compliance requirements
- Understand the security needs of internal and external stakeholders around external business partners and maintain a process that meets stakeholder needs
- Manage daily activities and functions of the external business partner management program
- Coordinate and drive business partner security assessment activities for both inbound and outbound relationships
- Lead assessments of business partner security risk, develop mitigation plans, and work with internal stakeholders to assign monitoring responsibility. Prepare and complete annual risk assessments and assist with regulatory and accreditation audit preparation as needed
- Support business partner selection on significant sourcing decisions and reassess security risk for business partners prior to contract renewal
Requirements
- 5+ years experience in information security compliance
- 2+ years experience supporting compliance programs within the technology space
- 5+ years experience in security controls across all security domains such as access management, encryption methods, vulnerability management, network security, etc.
- Project management skills
- Experience of data security frameworks and regulatory standards, including PCI, HITRUST, HIPAA and NIST CSF
- Experience with developing security and compliance reporting for a variety of audiences, including executive management
- Demonstrated leadership skills with experience working effectively across various levels
- Experience developing and submitting audit and compliance reports to governing bodies, legal entities, and/or external authorities
- Experienced in processes for assessing and designing internal controls for large scale organizations
- Experience assessing security risk for large scale organizations. Specific experience in cloud services organizations
- Certifications in one or more of the following areas preferred: CISSP, CISA, CISM, CRISC, GISO, GCIH, CIPP