Information Assurance Engineer/Technical Analyst Security Rule SME

This is a multi-year contract with anticipated start in mid-2022.

Primary responsibilities include:

• Reviews security and privacy complaints, data breach notification and cybersecurity incident reports, and other correspondence and evidence to determine whether the complaint, self-report or breach notification report indicates non-compliance with the HIPAA Security Rule. Reviews data provided by the healthcare organizations across the nation to assess the overall impact of security and privacy incidents.

• Evaluates and determines the technical sufficiency of submissions from HIPAA covered entities and business associates in response to data and documentation requests (i.e. Assessing reports related to security baselines, penetration tests, vulnerability assessments, and digital forensics). Develop reports summarizing the analysis along with formulating recommendations for OCR to consider for future action.

• Develops written reports with technical security analyses, summaries, and recommendations for action.

• Provides subject matter expert analysis, evaluation, and recommendations based on national security standards (NIST), industry best practices (ISO) and implementation specifications of the HIPAA Security Rule.

• Provides expert guidance in designing, implementing, and managing information security, data protection, and risk management programs, including policies, procedures, and controls for protected health information based on HIPAA requirements.

• Provides advisory expertise in the areas of risk analyses, vulnerability assessments, incident response, security architecture, physical security, business continuity and disaster recovery, enterprise mobility, threat intelligence and analysis, security awareness and online safety, and resolution of highly complex security projects and issues.

• Expert in the development and evaluation of health information privacy policies and technologies, specifically regarding protected health information; de-identified / re-identified health information; limited data sets

Basic Qualifications:

• Bachelor’s degree from an accredited college in a related discipline, or equivalent experience/combined education, with at least 8 years of professional experience of specific, hands-on experience actually doing work described in the preceding section

• In-depth experience with security domains and industry best practices; business continuity and disaster recovery, supply chain and third party management; and up to date on evolving cyber-threats, defense strategies, and emerging technology.

• Excellent written and oral communication skills.

• Ability to translate and communicate highly technical matter to a non-technical audience.

Preferred Qualifications:

• Knowledge of HIPAA Privacy, Security, and Breach Notification Rules, other Security regulations, and industry best practices and standards (NIST, ISO, Sarbanes-Oxley, FISMA, COBIT).

• Proficiencies in: Information governance and risk management, threat and vulnerability management, vendor management, infrastructure, security architecture for traditional, wireless, and cloud-hosted networks, cryptography/encryption protocols, business continuity and disaster recovery, social engineering and awareness training methodologies.

• Master’s degree in computer science, Information Technology, Cybersecurity or related field.

• Industry certification preferably CISSP, CISM, and CIPM/CIPP/CIPT.

Location options include: Atlanta, Boston, Chicago, Dallas, Washington, D.C., Denver, Los Angeles, New York City, Philadelphia, and San Francisco. Please note there is no relocation.

Please note the approved salary for this position will be around $120,000.

MEGA