Risk Analysis Specialist

Summary

Job Type

Contract

Description

Position Summary

Conducts the formal HIPAA Risk Analysis required under 45 CFR §164.308(a)(1)(ii)(A), identifying threats/vulnerabilities to ePHI, scoring likelihood and impact, and assigning risk levels using NIST SP 800-30 methodology.

Key Responsibilities

• Identify and document reasonably anticipated threats and vulnerabilities unique to each department.

• Assess likelihood of threat occurrence and magnitude of potential impact (qualitative and/or quantitative).

• Assign and document risk levels for all threat/vulnerability combinations.

• Recommend security controls to mitigate identified risks.

Requirements

Required Qualifications

• 4+ years of IT risk analysis experience using NIST SP 800-30 or comparable frameworks.

• Strong quantitative/qualitative risk-modeling skills.

• Experience producing formal risk analysis reports for regulated industries.

Preferred Qualifications

• CRISC or GRCP certification.

• Healthcare-sector risk analysis experience.

Travel

Fully remote; must remain within the continental United States.

Job Description

Job Type

Contract

Description

Position Summary

Conducts the formal HIPAA Risk Analysis required under 45 CFR §164.308(a)(1)(ii)(A), identifying threats/vulnerabilities to ePHI, scoring likelihood and impact, and assigning risk levels using NIST SP 800-30 methodology.

Key Responsibilities

• Identify and document reasonably anticipated threats and vulnerabilities unique to each department.

• Assess likelihood of threat occurrence and magnitude of potential impact (qualitative and/or quantitative).

• Assign and document risk levels for all threat/vulnerability combinations.

• Recommend security controls to mitigate identified risks.

Requirements

Required Qualifications

• 4+ years of IT risk analysis experience using NIST SP 800-30 or comparable frameworks.

• Strong quantitative/qualitative risk-modeling skills.

• Experience producing formal risk analysis reports for regulated industries.

Preferred Qualifications

• CRISC or GRCP certification.

• Healthcare-sector risk analysis experience.

Travel

Fully remote; must remain within the continental United States.