Senior Information Security Analyst

Description

From intake to outcomes, CareMetx is dedicated to delivering industry-leading patient access solutions and support services that help patients quickly start and stay on specialty therapy treatments. We provide scalable, efficient digital hub services for pharmaceutical companies and healthcare providers, streamlining workflows with seamless integration for patient enrollment, consent, and prior authorization. Our best-in-class patient support services enhance every step of care, connecting patients, providers, and brands to drive better outcomes and accelerate time-to-therapy.

Job Title: Senior Information Security Analyst

POSITION SUMMARY:

Under the general supervision of the Chief Information Security Officer (CISO), the Senior Information Security Analyst is the senior technical security resource at CareMetx. Day to day, this person monitors our compliance and vulnerability tooling, triages findings, opens and tracks remediation tickets with the technology groups that own the affected systems, participates in incident response alongside our managed security operations provider, coordinates the annual external penetration test, and provides technical support on customer and vendor security questions.

This is a full-time, senior individual contributor position with no direct reports. The position is remote (United States) and participates in a shared on-call rotation for after-hours security escalations.

PRIMARY DUTIES AND RESPONSIBILITIES:

Compliance monitoring

• •Monitor our governance, risk, and compliance (GRC) platform for technical controls that are failing or at risk, across SOC 2, HIPAA, and NIST CSF 2.0.
• •Evaluate each failing control to determine whether remediation is needed, what the right remediation is, and how it ranks against other open security issues.
• •Create tickets for the owning groups, prioritize them, and track work to completion within agreed service levels.
• •Document rationale for exceptions, accepted risks, and false positives.

Vulnerability management

• •Monitor vulnerability and cloud security alerts from our source code scanner, external vulnerability scanner, and cloud security posture tools.
• •Triage findings and assign severity.
• •Help build and operate the vulnerability management process: define key performance indicators (coverage, mean time to remediate, backlog by severity), produce regular metrics, and surface trends to security leadership.
• •Provide technical guidance to the groups performing the remediation.

Configuration assurance

• •Verify that workstation configurations meet the CareMetx-adopted CIS Benchmarks.
• •Identify gaps and work with the owning group on remediation.
• •Document and maintain written exceptions for approved deviations from the adopted standard.

Incident response and security operations

• •Answer calls and escalations from our managed security operations provider; serve as a first-line responder.
• •Participate in all phases of incident response: investigation, evidence collection and preservation, containment coordination with the owning groups, and post-incident review.
• •Help revise and maintain the Incident Response Plan.
• •Participate in and help facilitate incident response tabletop exercises; recommend improvements based on exercise findings.

External penetration test coordination

• •Coordinate the annual external penetration test end to end.
• •Ensure test environments are available and ready for the agreed test date; coordinate across the technology groups as needed.
• •Verify that identified gaps are remediated by the owning groups within agreed service levels.

Third-party and vendor risk

• •Support colleagues who own third-party risk management (TPRM) by answering technical questions on TPRM questionnaires and customer requests for proposal (RFPs).
• •For each new critical vendor, research breach history and public security reputation to determine whether the vendor is appropriate for use with sensitive data (including PHI).

SOC 2 and customer audit support

Assist in collecting and preparing evidence for SOC 2 audits and customer-driven audits, working with system owners to retrieve and confirm technical artifacts.

Shadow IT and AI monitoring

• •Monitor for unauthorized use of software-as-a-service (SaaS) applications and AI tools across the environment.
• •Investigate flagged usage, coordinate on next steps, and escalate material cases to the CISO.
• •Tune alerts from our cloud access, data protection, and similar monitoring tooling and act on the ones that matter.

Qualifications

EXPERIENCE AND EDUCATIONAL REQUIREMENTS:

• •7+ years in information security, security operations, vulnerability management, GRC, or a closely related role.
• •MS or bachelor's degree in Computer Science/MIS or a similar technical field is preferred.
• •Broad information technology experience in either infrastructure/operations or application development, with enough depth to anticipate when a change will have unexpected consequences or downstream impacts on other systems or teams.
• •Experience participating in security incident response, including evidence collection and preservation and coordination with a managed security operations or managed detection and response provider.

Preferred

• •Healthcare or other regulated-industry experience.
• •Certified Information Systems Security Professional (CISSP) certification

MINIMUM SKILLS, KNOWLEDGE AND ABILITY REQUIREMENTS:

• •Demonstrated experience designing and implementing repeatable, scalable processes that continue to function as the organization and workload grow.
• •Hands-on experience with a GRC / compliance-automation platform and with vulnerability scanning tools.
• •Working knowledge of SOC 2, the HIPAA Security Rule, NIST CSF 2.0, and CIS Benchmarks.
• •Working knowledge of public cloud security configuration and of a widely used enterprise productivity suite, sufficient to evaluate findings and advise owning groups.
• •Ability to read application dependency manifests, infrastructure-as-code, and cloud configurations well enough to distinguish real risk from false positives.
• •Able to explain technical risk in business terms to leadership, legal partners, and non-security technology groups.
• •Willingness and ability to participate in a shared on-call rotation for after-hours security escalations.

Preferred

Familiarity with data protection, cloud access security, or similar monitoring tooling, including alert tuning.

Physical Demands:

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• •While performing the duties of this job, the employee is regularly required to sit.
• •The employee must occasionally lift and/or move up to 10 pounds.

Work Environment:

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. The noise level in the work environment is usually moderate.

Schedule:

• •Must be flexible on schedule and hours.
• •Some Travel may be required.
• •Participates in a shared on-call rotation for after-hours security escalations.

CareMetx considers equivalent combinations of experience and education for most jobs. All candidates who believe they possess equivalent experience and education are encouraged to apply.

At CareMetx we work hard, we believe in what we do, and we want to be a company that does right by our employees. Our niche industry is an integral player in getting specialty products and devices to the patients who need them by managing reimbursements for those products, identifying alternative funding when insurers do not pay, and providing clinical services.

CareMetx i