IT Security Analyst II

Capital Health is the region's leader in providing progressive, quality patient care with significant investments in our exceptional physicians, nurses and staff, as well as advanced technology. Capital Health is a dynamic health care resource accredited by the DNV that includes two hospitals, an outpatient center, satellite ED, and an expansive network of primary and specialty care. Capital Health Medical Group is made up of more than 600 physicians and other providers who offer primary and specialty care, as well as hospital-based services, to patients throughout the region.

Capital Health recognizes that attracting the best talent is key to our strategy and success as an organization. As a result, we aim for flexibility in structuring competitive compensation offers to ensure we can attract the best candidates.

The listed pay range or pay rate reflects compensation for a full-time equivalent (1.0 FTE) position. Actual compensation may differ depending on assigned hours and position status (e.g., part-time).

Pay Range:

$108,139.20 - $141,294.40

Scheduled Weekly Hours:

40

Position Overview

SUMMARY (Basic Purpose of the Job):

The IT Security Analyst II independently owns and manages core information security programs, including third-party risk management (TPRM), Security Awareness Training, and Application Security Assessments. This role serves as a trusted resource for staff and leaders regarding information security policy implementation, interpretation, and compliance, and drafts and maintains information security policies, standards, and procedures. Building on the foundation of the IT Security Analyst I role, this position operates with greater autonomy, owns end-to-end programs and initiatives, and provides mentorship and guidance to less experienced team members. The position assesses and prioritizes information security and cybersecurity risk across the organization, facilitates compliance with regulatory requirements and information security policies, and develops and reports on information security metrics.

MINIMUM REQUIREMENTS:

Education: Bachelor's degree in a relevant field or equivalent experience.

Experience: Three years demonstrated experience in cybersecurity, GRC, vulnerability management, TPRM, or related roles, including experience gained as an IT Security Analyst I or in an equivalent role required. Working knowledge of NIST CSF, HIPAA, or other security/regulatory frameworks required. CompTIA Security+ required. One or more mid-level certifications such as CompTIA CySA+ or ISACA CRISC preferred (or equivalent). Progress toward or attainment of ISACA CISM, CISA, or ISC2 CISSP is a plus.

Knowledge and Skills: Strong working knowledge of desktop, server, storage, virtualization, networking, and security technologies. Demonstrated ability to independently lead risk assessments, vendor risk reviews, and vulnerability remediation efforts, and to translate technical findings into business risk language for non-technical stakeholders.

Special Training: A+, Network+, Security+, CySA+, CRISC, or other relevant IT security certifications are a plus.

Mental, Behavioral and Emotional Abilities: Ability to work independently with minimal supervision, exercise sound judgment on risk-based decisions, mentor junior staff, and communicate effectively with both technical and non-technical audiences under time-sensitive conditions.

ESSENTIAL FUNCTIONS

Owns and manages the third-party risk management (TPRM) program end-to-end, including vendor classification logic, risk scoring methodology, intake routing/workflows, assessment questionnaires, and reassessment tracking; serves as the primary point of contact for vendor risk questions across the organization.

Independently drives vendor risk assessments from initial outreach through closure, including follow-up with unresponsive vendors, review of vendor-submitted documentation, and escalation of high-risk or unresolved vendor relationships to leadership.

Administers the organization's enterprise phishing simulation program, including campaign design and scheduling, execution, data collection, results analysis, and reporting of metrics and trends to leadership.

Performs Application Security Assessments for new and existing software, evaluating security posture and providing risk-based recommendations to stakeholders.

Owns and manages the software request and review process, evaluating new software and vendor tools for security risk prior to approval and onboarding.

Provides broader support to overall GRC program strategy and planning, partnering with the IT Manager on initiatives such as multi-campaign phishing simulation roadmaps, TPRM process improvements, and team capacity/workload planning for a small, high-throughput GRC team.

Researches, drafts, and maintains information security policies, standards, procedures, and performs detailed policy reviews. Tracks and reports on remediation progress for regulatory and framework-based gap assessments (e.g., HIPAA Security Rule), maintaining a remediation tracker and coordinating with control owners to close identified gaps.

Develops and maintains security awareness training content for staff and management audiences, including designing and updating training presentation materials with current statistics and emerging threat topics.

Coordinates examinations by qualified security assessors for regulations and frameworks such as HIPAA and NIST, working with control owners and external assessors to ensure evidence requests are completed timely and accurately.

Monitors security alerts, analyzes incidents, and contributes to incident response activities in coordination with the Security Operations team and IT Manager.

Manages the exception review and approval process, ensuring exceptions are documented, risk-rated, and reviewed on schedule. Applies current threat intelligence and security trends to inform TPRM, awareness training, and policy work.

Collaborates closely with the IT Manager and Security Operations team on day-to-day operational challenges and contributes to effective, sustainable solutions as part of a small, high-throughput GRC team.

Mentors and provides guidance to IT Security Analyst I team members and other GRC support staff, including knowledge transfer, review of work products, and onboarding support; serves as a go-to resource for procedural and technical questions within the GRC team.

Maintains comprehensive documentation of TPRM activities, vendor assessments, security awareness training and phishing simulation activities, and policy review work.

Generates and analyzes regular reports on information security metrics (e.g., phishing simulation results, vendor assessment status, remediation tracking) for management review, identifying trends and improvement opportunities.

Fosters a culture of security awareness and best practices within the organization.

Stays informed of industry best practices, emerging threats, and advancements in cybersecurity, and pursues relevant certifications and training to enhance expertise.

Performs other duties as assigned.

PHYSICAL DEMANDS AND WORK ENVIRONMENT

Frequent physical demands include:

Occasional physical demands include: Standing , Walking , Climbing (e.g., stairs or ladders) , Carry objects , Push/Pull , Twisting , Bending , Reaching forward , Reaching overhead , Squat/kneel/crawl , Wrist position deviation , Pinching/fine motor activities

Continuous physical demands include: Sitting , Keyboard use/repetitive motion

Lifting Floor to Waist 15 lbs. Lifting Waist Level and Above 10 lbs.

Sensory Requirements include: Accurate Near Vision, Accurate Far Vision, Color Discrimination, Minimal Depth Perception, Accurate Hearing

Anticipated Occupational Exposure Risks Include the following: N/A

This position is eligible for the following benefits:

Medical Plan

Prescription drug coverage & I