Senior Security Compliance Analyst

We are seeking a Senior Security Compliance Analyst with expertise in Governance, Risk, and Compliance (GRC) to support and enhance our security and compliance programs within the healthcare industry. This role is critical in ensuring adherence to industry regulations, responding to customer audits, and maintaining compliance with ISO 27001, HIPAA, and other security frameworks.

The ideal candidate will be a detail-oriented compliance expert who can navigate complex regulatory environments, assist with internal/external audits, and drive continuous improvement in security governance.

What You’ll Be Working On

• Audit & Compliance Management
  • Lead and support customer security audits, responding to security questionnaires and demonstrating compliance with security frameworks.
  • Prepare, coordinate, and manage ISO 27001 audits, including evidence collection, control implementation, and auditor engagement.
  • Ensure ongoing compliance with HIPAA, NIST CSF, and other regulatory requirements applicable to healthcare data security.
  • Develop and maintain policies, procedures, and security documentation to meet regulatory and contractual obligations.
  • Perform gap analyses and risk assessments to identify and remediate compliance risks.
• Governance & Risk Management
  • Manage and improve security governance frameworks, ensuring alignment with industry best practices and business objectives.
  • Conduct third-party vendor risk assessments, ensuring compliance with security policies and contractual obligations.
  • Monitor security controls, ensuring effectiveness and continuous improvement in alignment with security frameworks.
  • Support security awareness training initiatives, ensuring employees understand compliance responsibilities.
• Regulatory & Framework Support
  • Stay current on ISO 27001, HIPAA, NIST 800-53, and other relevant standards, translating them into actionable security controls.
  • Assist in defining security metrics and reporting on compliance status and risk posture to leadership.
  • Work closely with legal, security, IT, and business teams to align compliance requirements with security operations.

What You’ll Bring to OneStudyTeam

• 8+ years of experience in GRC, compliance, risk management, or IT audit, with a focus on ISO 27001, HIPAA, and HITRUST.
• Experience leading ISO 27001 audits, including ISMS implementation and external audit coordination.
• Strong understanding of NIST CSF, SOC 2, GDPR, and other security frameworks.
• Hands-on experience with customer security audits, including responding to security questionnaires and managing security assessments.
• Ability to perform risk assessments, policy reviews, and compliance gap analyses.
• Familiarity with GRC tools (e.g., OneTrust, LogicGate, Archer, Vanta, Drata) is a plus.
• Certifications (Preferred): ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CISA, HITRUST CCSFP, CRISC.