Risk and Compliance Analyst

Highmark Health is seeking a Risk and Compliance Analyst in Pittsburgh, Allegheny County, PA to support enterprise‑wide risk assessments across frameworks such as NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, and JCAHO. The role offers a salary of $75,585.72.

Key Responsibilities

• Conduct risk and compliance assessments aligned with multiple regulatory and industry standards.
• Partner with business units, technology teams, and global delivery partners to identify, evaluate, and remediate risk exposures.
• Develop and maintain documentation, policies, and controls to ensure ongoing compliance.
• Assist in preparing audit evidence and responding to internal and external audit inquiries.
• Monitor emerging regulatory changes and recommend updates to controls and processes.
• Support incident response and root‑cause analysis activities related to compliance failures.

Required Qualifications

• Bachelor’s degree in Information Security, Risk Management, Healthcare Administration, or a related field.
• 2+ years of experience in risk assessment, compliance, or audit within the healthcare or financial services sector.
• Familiarity with NIST, HITRUST, PCI DSS, HIPAA, SOC, MAR, CMS, and JCAHO frameworks.
• Strong analytical, communication, and stakeholder‑management skills.
• Ability to work collaboratively across cross‑functional teams and manage multiple priorities.

Preferred Skills

• Professional certifications such as CISA, CISSP, CRISC, or HCISPP.
• Experience with risk management tools and GRC platforms.
• Knowledge of cloud security and data privacy regulations.

Frequently Asked Questions

What frameworks will I work with as a Risk and Compliance Analyst at Highmark Health?

You will assess and support compliance with NIST, HITRUST, PCI DSS, HIPAA, SOC, MAR, CMS, JCAHO and related standards.

What experience is required for this role?

At least two years of risk assessment or compliance experience in healthcare or a regulated industry, plus a relevant bachelor’s degree.

Is certification required for this position?

Certifications are not required but preferred; examples include CISA, CISSP, CRISC, or HCISPP.