Risk and Compliance Analyst

Job Summary

Highmark Health is seeking a Risk and Compliance Analyst in Camp Hill, Cumberland County, US. This role supports risk and compliance assessments across frameworks such as NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, and JCAHO.

Key Responsibilities

• Collaborate with risk owners and business partners to identify, assess, and mitigate compliance gaps.
• Conduct audits and assessments against industry frameworks (NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO).
• Document findings, develop remediation plans, and track remediation progress.
• Partner with technology teams and global delivery groups to ensure security controls align with enterprise risk appetite.
• Prepare and present compliance reports for senior leadership and external regulators.
• Stay current on regulatory changes and industry best practices, advising the organization on emerging risks.

Qualifications

• Bachelor’s degree in Information Security, Risk Management, Healthcare Administration, or related field.
• 3+ years of experience in risk analysis, compliance auditing, or healthcare security.
• Strong knowledge of NIST, HITRUST, PCI DSS, HIPAA, SOC, MAR, CMS, and JCAHO standards.
• Excellent analytical, communication, and stakeholder‑management skills.
• Relevant certifications (CISA, CISM, CRISC, HITRUST CSF) are a plus.

Compensation

Salary: $85,488.76 per year.

Why Join Highmark Health?

Be part of a mission‑driven organization dedicated to improving health outcomes while maintaining the highest standards of security and compliance.

Frequently Asked Questions

What frameworks will I work with as a Risk and Compliance Analyst?

You will assess and support compliance with NIST, HITRUST, PCI DSS, HIPAA, SOC, MAR, CMS, and JCAHO frameworks.

What experience is required for this position?

At least 3 years of experience in risk analysis, compliance auditing, or healthcare security, with knowledge of the listed frameworks.

Is certification required?

Certifications such as CISA, CISM, CRISC, or HITRUST CSF are preferred but not mandatory.