Principal Cybersecurity Analyst - Governance, Risk, Compliance

Leads the Cybersecurity Risk & Compliance Program by defining program strategy, developing/improving core processes, managing daily workflows, and directing the team to manage cybersecurity risk and compliance across the institution’s application, server, and cloud assets for stakeholders.

Cybersecurity Risk & Compliance Program Leadership & Governance
Lead the operations and strategic direction of the institution’s cybersecurity risk and compliance program across application, server, and cloud assets to identify, assess, treat, and monitor risk and protect patient care, research, and clinical operations.

Conduct and oversee risk and compliance assessments, control assurance, and risk-register management, and drive strategic improvements to program governance, methodologies, and workflow efficiency.

Establish and refine program standards, policies, and procedures aligned with institutional risk tolerance and regulatory and compliance requirements (e.g., NIST, HIPAA, HITRUST).

Team Supervision, Guidance & Subject Matter Expertise
Supervise, mentor, and develop a team of cybersecurity risk and compliance analysts; set priorities, manage workload, and support professional growth and performance.

Serve as the subject matter expert for cybersecurity risk and compliance, providing technical guidance, escalation support, and coaching to team members.

Foster a culture of accountability, collaboration, and continuous improvement.

Cross-Functional Partnerships & Collaboration
Develop and enhance partnerships with IT, infrastructure, application, cloud, and business and clinical support teams to improve cross-functional effectiveness and collaboration.

Coordinate risk assessment and remediation activities with system, application, and cloud service owners, ensuring shared understanding of risk, priorities, and timelines.

Serve as a liaison between Cybersecurity and support teams to resolve barriers and drive timely, effective risk treatment.

Performance Monitoring & Structured Program Reviews
Conduct structured weekly and monthly reviews to ensure alignment on issues, updates, and performance data.

Define, track, and report key performance indicators (KPIs) and key risk indicators (KRIs) to measure program health and inform data-driven decisions.

Identify trends, gaps, and improvement opportunities from risk and performance data and take corrective action.

SLA Management & Cybersecurity Point of Contact
Serve as the point of contact for Cybersecurity to ensure risk and compliance service level agreements (SLAs) are consistently met.

Monitor SLA compliance, escalate at-risk items, and coordinate risk treatment to meet or exceed defined targets.

Communicate program status, risks, and SLA performance to leadership and stakeholders.

Program Documentation & Reporting
Develop and maintain comprehensive program documentation, including risk assessments, the risk register, standard operating procedures, and reporting, to ensure accuracy, clarity, and auditability.

Ensure documentation supports consistent execution, onboarding, knowledge transfer, and audit readiness.

Leadership Support & Special Assignments
Complete designated tasks, projects, and responsibilities as assigned by leadership.

Support departmental and institutional cybersecurity initiatives and continuous improvement efforts as needed.

Other duties as assigned