Governance, Risk and Compliance Analyst, Progyny

• BS/BA in a related discipline or related work experience
• Working knowledge of HIPAA or common compliance standards like PCI, SOX, or NIST
• Strong analytical thinker who is organized and detail-oriented
• Experience with working to deadlines and the ability to organize tasks within those deadlines
• Team oriented approach to meeting our compliance requirements
• Excellent verbal and written communication skills

Desirable

• The successful candidate will assist in the development and implementation of the Information Security program
• The Governance, Risk and Compliance Analyst is responsible for the facilitation, operation, and maintenance of Governance, Risk & Compliance efforts to support our Information Security and Compliance goals and objectives
• The role will be heavily focused on remediating information security controls, supporting audits for the company certification programs, performing security reviews of our vendors and partners on a regular basis, and assist with tasks that the Lead GRC Analyst identifies
• This position interacts with all levels of the business, and calls for adaptability, advocating for flexible strategies, and a thorough grasp of compliance requirements and our operations
• Success in this position depends on the ability to drive new compliance initiatives across various departments while maintaining professionalism and composure under pressure
• Conducts security assessments and audits of vendors through our vendor risk management platform. Prepares and coordinates corrective actions
• Assist with the enforcement of information security policies, standards, and guidelines
• Participates in tabletop exercises related to incident response and disaster recovery procedures
• Assist with the delivery of annual security awareness and privacy trainings
• Assist with implementing Security GRC projects dashboard reporting
• Participate in the internal audit program
• Assist with remediation of control deficiencies and gaps identified internally and externally for SOC 2 TYPE II & HITRUST certification
• Assist Control Owners in the maintenance & remediation of control activities for Internal Audit
• Contributes to the long-term information security roadmap