Security Analyst

Location

8326 Naab Road, Indianapolis, IN 46260

Work Arrangement: Hybrid – 3 days onsite per week (No exceptions)

Interview: Onsite interview required

Experience: 3–5 years of progressive cybersecurity operations experience; alternatively, 6–8 years of related experience

Education: Associate degree in a related field required; Bachelor's degree preferred

Healthcare Experience: Prior healthcare IT experience required for this search

Communication: Excellent spoken English required

Other Requirements: Valid driver's license and insured automobile.

Position Summary

seeking an experienced Security Analyst to join its Information Technology team.

This role bridges tactical cybersecurity defense with regulatory compliance oversight to safeguard electronic Protected Health Information (e-PHI) and hybrid cloud systems.

The Security Analyst will administer the enterprise Vulnerability Management Program (VMP), serve as the primary technical point of contact for the Managed Security Service Provider (MSSP), triage security alerts from multiple sources, manage workforce security awareness training, and coordinate compliance audit evidence.

The role supports four IT verticals:

· Applications

· Data & Analytics

· Cloud & DevOps

· IT Operations

Key Responsibilities

1. Vulnerability Management Program Administration

· Own and administer the day-to-day enterprise Vulnerability Management Program across endpoints, servers, databases, and hybrid cloud infrastructure.

· Coordinate routine vulnerability scanning schedules.

· Analyze scanning results and validate findings against threat intelligence and operational risk.

· Partner with IT Operations and Cloud & DevOps teams to prioritize, track, and validate remediation of critical and high vulnerabilities within established SLAs.

· Document and track risk exceptions and remediation roadblocks.

2. Security Alert Monitoring, Incident Triage & MSSP Collaboration

· Serve as the primary technical point of contact for the external MSSP.

· Manage daily operational handoffs, alert escalations, and SLA performance.

· Monitor, analyze, and triage security alerts across EDR, cloud workloads, identity providers, and email filtering systems.

· Investigate employee phishing submissions and suspected compromised credential alerts.

· Escalate confirmed incidents according to the Incident Response Plan.

3. Compliance Oversight & Audit Readiness

· Evaluate technical, physical, and administrative safeguards against:

o HIPAA Security Rule (45 CFR Part 164)

o URAC accreditation standards (Core OPIN & RM modules)

o NIST CSF 2.0

o NIST SP 800-53

o PCI DSS v4.0

· Coordinate technical compliance artifacts, audit evidence, and system configuration logs across IT teams.

· Support external audits, annual HIPAA risk assessments, and accreditation renewals.

· Conduct access control list, privileged user activity, and third-party vendor access audits.

· Ensure adherence to least-privilege and minimum-necessary principles.

4. Security Awareness Training & Human Risk Management

· Build, schedule, and administer monthly workforce security awareness training.

· Conduct unannounced simulated phishing campaigns using the enterprise LMS platform.

· Track training completion rates, phish-prone percentages, and compliance metrics.

· Collaborate with HR and Compliance to address recurring training delinquencies and phishing failures.

5. Cross-Functional IT Collaboration

IT Operations

· Support endpoint hardening.

· Assist with Windows Server security baselines.

· Support Active Directory hygiene.

Cloud & DevOps

· Collaborate on AWS security groups and IAM least privilege.

· Support container and pipeline security.

· Work with AWS network infrastructure.

Applications & Data

· Review third-party software risks.

· Support database access governance.

· Review API integrations and secure data-handling baselines.

Required Knowledge

· Strong working knowledge of HIPAA Security Rule, URAC Core Standards, NIST CSF 2.0 / SP 800-53, and PCI DSS.

· Understanding of vulnerability scanning platforms, CVSS, and remediation methodologies.

· Knowledge of Microsoft 365 security suite, Windows Server, endpoint EDR solutions, and PowerShell scripting.

· Understanding of AWS security groups, IAM roles, VPC architecture, and S3 buckets.

· Understanding of enterprise identity concepts, including SSO, MFA, and RBAC.

Required Skills

· Ability to assess security alerts quickly and correlate logs from different systems.

· Ability to distinguish false positives from genuine security incidents.

· Strong organization and prioritization skills.

· Ability to manage multiple audit requests, remediation schedules, and operational support tickets.

· Clear communication with teammates and end users.

Required Abilities

· Translate technical vulnerabilities and compliance controls into understandable language for clinical, operational, and executive stakeholders.

· Work independently while collaborating across IT teams.

· Handle sensitive investigations, security incidents, and protected healthcare information with discretion and integrity.

Additional Information

· Minimal travel for training or conferences.

· Professional office environment.

· Must be comfortable with a hybrid schedule requiring three onsite days per week in Indianapolis.

· Must be available for an onsite interview.

· Excellent spoken English is essential.

Referrals are Greatly Appreciated!

Thanks!!!

Pay: $34.11 - $37.99 per hour

Expected hours: 40.0 per week

Experience:

• Healthcare: 1 year (Required)

Location:

• Indianapolis, IN 46260 (Required)

Work Location: Hybrid remote in Indianapolis, IN 46260