Consultant - Health Information Technology Security Compliance Consultant
NYSTEC is a nonprofit technology consulting company that has been advising various organizations since 1996. As a health information technology security compliance consultant, you will support clients with security compliance initiatives and governance, risk, and compliance activities in the health information technology sector.
Responsibilities
- Supporting organizations with governance, risk, and compliance (GRC) activities in support of significant health information technology (HIT) programs
- Providing support for establishing security awareness and training, incident response, disaster recovery, vulnerability management, and software development life cycle (SDLC) programs
- Learning and applying knowledge of National Institute of Standards and Technology (NIST) 800-30 risk assessments, NIST 800-53 compliance assessments, and the NIST Cybersecurity Framework (CSF)
- Working with a team and with the client to ensure that their contractors adhere to all applicable security and privacy requirements — as included in federal and state law, regulation, policy, and contractual requirements
Skills
- Skills that cross multiple security domains — should be familiar with the software development life cycle (SDLC), assessing risk, and able to understand the root causes of vulnerabilities and to articulate those in written and verbal communications to clients
- Understanding of Health Insurance Portability and Accountability Act (HIPAA) security and privacy requirements
- Understanding of NIST 800-53 controls
- Knowledge of the NIST CSF
- Excellent communication and writing skills
- Knowledge of NIST 800-30 style risk assessments
- Knowledge of Health Information Trust Alliance (HITRUST) certification
- A bachelor's degree in a related field of study with one year of experience
- An equivalent combination of advanced education, training, and experience will be considered
- A certified information systems security professional (CISSP) or other skill-specific security certification
Company Overview