{"schemaVersion":"jobsearcher.job.v1","id":"fb377f01d63dd1c5fda8a379","url":"https://jobsearcher.com/jobs/fb377f01d63dd1c5fda8a379","canonicalUrl":"https://jobsearcher.com/jobs/fb377f01d63dd1c5fda8a379","title":"Information Security Risk Analyst - Intermediate","description":"Join a world-class academic healthcare system, UChicago Medicine, as an Information Security Risk Analyst – Intermediatein our Information Security and Privacy GRCdepartment. This position will be primarily a work-from-home opportunity with the requirement to come onsite as needed. You will need to be based in the greater Chicagoland area.\r\nThe Information Security Risk Analyst – Intermediate plays a critical role within the Governance, Risk and Compliance (GRC) team in executing and enhancing the organization's information security risk management program. The analyst will independently conduct risk analysis on information systems, platforms, and processes in accordance with established regulatory requirements, organizational policies, and industry standards. The analyst will lead and contribute to the identification, assessment, documentation, mitigation, and communication of information security risks across the organization.\r\nThis position supports risk-driven decision-making by collaborating with stakeholders, managing risk treatment plans, and ensuring compliance with HIPAA, NIST, and other applicable healthcare cybersecurity regulations and frameworks. The analyst is expected to operate with moderate independence, assist in maturing risk workflows, and contribute to strategic improvements in governance, risk, and compliance activities.\r\nThe ideal candidate will have a strong understanding of security frameworks, risk assessment methodologies, risk assessments, risk registers, and the management of audit and penetration testing findings. The ideal candidate should be adept at monitoring regulatory developments while promoting a culture of risk awareness across the organization.\r\nEssential Job Functions Lead and conduct comprehensive information security risk analysis for IT assets, applications, processes, medical devices and third-party vendors.\r\nEvaluate threats and vulnerabilities affecting the confidentiality, integrity, and availability of electronic protected health information (ePHI) and any other confidential or sensitive information, ensuring alignment with HIPAA Security Rule requirements and other applicable regulatory frameworks (e.g., NIST,).\r\nLead and manage risk management initiatives based on analysis of outcomes, including maintaining the organization's risk register and scoring methodology.\r\nOversee corrective action plans (CAPs), penetration testing results, audit findings, and risk treatment outcomes.\r\nCollaborate with IT partners and key stakeholders to prioritize, implement, and track remediation efforts.\r\nMonitor regulatory changes and industry threats to proactively identify emerging risks, recommend mitigation strategies, and document findings.\r\nContribute to risk reporting, including executive dashboards, and participate in risk acceptance processes and governance reviews.\r\nContribute to the development, review, and improvement of cybersecurity policies, standards, and procedures.\r\nEvaluate policy exceptions and assist in documenting decisions for governance committees.\r\nEnhance the organization's cybersecurity awareness and training efforts by communicating risk insights to technical and non-technical audiences.\r\nOther duties as assigned\r\nRequired Qualifications Bachelor's degree required in Information Security, Computer Science, Engineering, Information Technology, or a related field; master's degree preferred\r\n3+ years of experience in cybersecurity, information security risk management, audit; healthcare industry experience strongly preferred\r\nDemonstrated experience with risk assessment methodologies, auditing, information security practices, and familiarity with risk management platforms and risk registers\r\nStrong understanding of regulatory compliance and industry best practices towards maintaining compliance with HIPAA, NIST and other relevant healthcare regulations and standards\r\nOne or more of the following certifications are required or must be obtained within 12 months of hire: CRISC, CISM, CISA or any other applicable certification\r\nAbility to lead and structure risk assessments with limited supervision\r\nAbility to manage multiple concurrent assessments and projects in a fast-paced healthcare setting\r\nExperience preparing both detailed technical risk reports and executive-level summaries, tailored to varied audiences to support informed decision-making and governance oversight\r\nAbility to build strong cross-functional relationships and collaboration across departments, including IT, Legal, Compliance, Clinical Operations, and Privacy, to support a collaborative approach to risk management and governance\r\nStrong written and verbal communication and interpersonal skills, including ability to translate technical findings into business-relevant language for leadership audiences\r\nExperience tracking audit findings, third party vendor risks, and remediation efforts\r\nFamiliarity with security platforms and tools\r\nAbility to analyze contractual security language to identify risk exposure and recommend controls\r\nAbility to learn quickly and work effectively in a team environment\r\nAbility to understand and work with healthcare professionals, educators, and researchers\r\nAbility to integrate cybersecurity risk management with business operations, healthcare delivery, and IT services\r\nPosition Details Job Type/FTE: Full Time\r\nShift: Days\r\nLocation: Flexible (Hyde Park; Darien)\r\nUnit/Department: Information Security Office\r\nCBA Code: Non-Union\r\nWe've been at the forefront of medicine since 1899. We provide superior healthcare with compassion, always mindful that each patient is a person, an individual. To accomplish this, we need employees with passion, talent and commitment… with patients and with each other. We're in this together: working to advance medical innovation, serve the health needs of the community, and move our collective knowledge forward. If you'd like to add enriching human life to your profile, UChicago Medicine is for you. Here at the forefront, we're doing work that really matters. Join us. Bring your passion.\r\nUChicago Medicine is growing; discover how you can be a part of this pursuit of excellence at: UChicago Medicine Career Opportunities https://www.uchicagomedicine.org/about-us/careers\r\nUChicago Medicine is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, ethnicity, ancestry, sex, sexual orientation, gender identity, marital status, civil union status, parental status, religion, national origin, age, disability, veteran status and other legally protected characteristics.\r\nAs a condition of employment, all employees are required to complete a pre-employment physical, background check, drug screening, and comply with the flu vaccination requirements prior to hire. Medical and religious exemptions will be considered for flu vaccination consistent with applicable law.\r\nCompensation & Benefits Overview UChicago Medicine is committed to transparency in compensation and benefits. The pay range provided reflects the anticipated wage or salary reasonably expected to be offered for the position.\r\nThe pay range is based on a full-time equivalent (1.0 FTE) and is reflective of current market data, reviewed on an annual basis. Compensation offered at the time of hire will vary based on candidate qualifications and experience and organizational considerations, such as internal equity. Pay ranges for employees subject to Collective Bargaining Agreements are negotiated by the medical center and their respective union.\r\nReview the full complement of benefit options for eligible roles at Benefits - UChicago Medicine https://www.uchicagomedicine.org/about-us/careers/benefits.\r\nJ-18808-Ljbffr","company":"Socket","rawCompany":"socket","city":"Darien","state":"IL","isRemote":false,"isActive":false,"createdAt":"2026-08-08T01:38:05.533Z","occupations":[{"code":"15-1212.00","title":"Information Security Analysts","slug":"information-security-analysts"},{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"13-1199.07","title":"Security Management Specialists","slug":"security-management-specialists"}],"industries":[{"code":"622110","title":"General Medical and Surgical Hospitals","slug":"general-medical-and-surgical-hospitals"},{"code":"621111","title":"Offices of Physicians (except Mental Health Specialists)","slug":"offices-of-physicians-except-mental-health-specialists"},{"code":"622310","title":"Specialty (except Psychiatric and Substance Abuse) Hospitals","slug":"specialty-except-psychiatric-and-substance-abuse-hospitals"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Information Security Risk Analyst - Intermediate","description":"Join a world-class academic healthcare system, UChicago Medicine, as an Information Security Risk Analyst – Intermediatein our Information Security and Privacy GRCdepartment. This position will be primarily a work-from-home opportunity with the requirement to come onsite as needed. You will need to be based in the greater Chicagoland area.\r\nThe Information Security Risk Analyst – Intermediate plays a critical role within the Governance, Risk and Compliance (GRC) team in executing and enhancing the organization's information security risk management program. The analyst will independently conduct risk analysis on information systems, platforms, and processes in accordance with established regulatory requirements, organizational policies, and industry standards. The analyst will lead and contribute to the identification, assessment, documentation, mitigation, and communication of information security risks across the organization.\r\nThis position supports risk-driven decision-making by collaborating with stakeholders, managing risk treatment plans, and ensuring compliance with HIPAA, NIST, and other applicable healthcare cybersecurity regulations and frameworks. The analyst is expected to operate with moderate independence, assist in maturing risk workflows, and contribute to strategic improvements in governance, risk, and compliance activities.\r\nThe ideal candidate will have a strong understanding of security frameworks, risk assessment methodologies, risk assessments, risk registers, and the management of audit and penetration testing findings. The ideal candidate should be adept at monitoring regulatory developments while promoting a culture of risk awareness across the organization.\r\nEssential Job Functions Lead and conduct comprehensive information security risk analysis for IT assets, applications, processes, medical devices and third-party vendors.\r\nEvaluate threats and vulnerabilities affecting the confidentiality, integrity, and availability of electronic protected health information (ePHI) and any other confidential or sensitive information, ensuring alignment with HIPAA Security Rule requirements and other applicable regulatory frameworks (e.g., NIST,).\r\nLead and manage risk management initiatives based on analysis of outcomes, including maintaining the organization's risk register and scoring methodology.\r\nOversee corrective action plans (CAPs), penetration testing results, audit findings, and risk treatment outcomes.\r\nCollaborate with IT partners and key stakeholders to prioritize, implement, and track remediation efforts.\r\nMonitor regulatory changes and industry threats to proactively identify emerging risks, recommend mitigation strategies, and document findings.\r\nContribute to risk reporting, including executive dashboards, and participate in risk acceptance processes and governance reviews.\r\nContribute to the development, review, and improvement of cybersecurity policies, standards, and procedures.\r\nEvaluate policy exceptions and assist in documenting decisions for governance committees.\r\nEnhance the organization's cybersecurity awareness and training efforts by communicating risk insights to technical and non-technical audiences.\r\nOther duties as assigned\r\nRequired Qualifications Bachelor's degree required in Information Security, Computer Science, Engineering, Information Technology, or a related field; master's degree preferred\r\n3+ years of experience in cybersecurity, information security risk management, audit; healthcare industry experience strongly preferred\r\nDemonstrated experience with risk assessment methodologies, auditing, information security practices, and familiarity with risk management platforms and risk registers\r\nStrong understanding of regulatory compliance and industry best practices towards maintaining compliance with HIPAA, NIST and other relevant healthcare regulations and standards\r\nOne or more of the following certifications are required or must be obtained within 12 months of hire: CRISC, CISM, CISA or any other applicable certification\r\nAbility to lead and structure risk assessments with limited supervision\r\nAbility to manage multiple concurrent assessments and projects in a fast-paced healthcare setting\r\nExperience preparing both detailed technical risk reports and executive-level summaries, tailored to varied audiences to support informed decision-making and governance oversight\r\nAbility to build strong cross-functional relationships and collaboration across departments, including IT, Legal, Compliance, Clinical Operations, and Privacy, to support a collaborative approach to risk management and governance\r\nStrong written and verbal communication and interpersonal skills, including ability to translate technical findings into business-relevant language for leadership audiences\r\nExperience tracking audit findings, third party vendor risks, and remediation efforts\r\nFamiliarity with security platforms and tools\r\nAbility to analyze contractual security language to identify risk exposure and recommend controls\r\nAbility to learn quickly and work effectively in a team environment\r\nAbility to understand and work with healthcare professionals, educators, and researchers\r\nAbility to integrate cybersecurity risk management with business operations, healthcare delivery, and IT services\r\nPosition Details Job Type/FTE: Full Time\r\nShift: Days\r\nLocation: Flexible (Hyde Park; Darien)\r\nUnit/Department: Information Security Office\r\nCBA Code: Non-Union\r\nWe've been at the forefront of medicine since 1899. We provide superior healthcare with compassion, always mindful that each patient is a person, an individual. To accomplish this, we need employees with passion, talent and commitment… with patients and with each other. We're in this together: working to advance medical innovation, serve the health needs of the community, and move our collective knowledge forward. If you'd like to add enriching human life to your profile, UChicago Medicine is for you. Here at the forefront, we're doing work that really matters. Join us. Bring your passion.\r\nUChicago Medicine is growing; discover how you can be a part of this pursuit of excellence at: UChicago Medicine Career Opportunities https://www.uchicagomedicine.org/about-us/careers\r\nUChicago Medicine is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, ethnicity, ancestry, sex, sexual orientation, gender identity, marital status, civil union status, parental status, religion, national origin, age, disability, veteran status and other legally protected characteristics.\r\nAs a condition of employment, all employees are required to complete a pre-employment physical, background check, drug screening, and comply with the flu vaccination requirements prior to hire. Medical and religious exemptions will be considered for flu vaccination consistent with applicable law.\r\nCompensation & Benefits Overview UChicago Medicine is committed to transparency in compensation and benefits. The pay range provided reflects the anticipated wage or salary reasonably expected to be offered for the position.\r\nThe pay range is based on a full-time equivalent (1.0 FTE) and is reflective of current market data, reviewed on an annual basis. Compensation offered at the time of hire will vary based on candidate qualifications and experience and organizational considerations, such as internal equity. Pay ranges for employees subject to Collective Bargaining Agreements are negotiated by the medical center and their respective union.\r\nReview the full complement of benefit options for eligible roles at Benefits - UChicago Medicine https://www.uchicagomedicine.org/about-us/careers/benefits.\r\nJ-18808-Ljbffr","datePosted":"2026-08-08T01:38:05.533Z","dateModified":"2026-08-08T01:38:05.533Z","hiringOrganization":{"@type":"Organization","name":"Socket","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Darien","addressRegion":"IL","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"fb377f01d63dd1c5fda8a379"},"url":"https://jobsearcher.com/jobs/fb377f01d63dd1c5fda8a379"}}