| Location | Detroit, MI |
Job Description
The IT Security Specialist I / EIS Compliance & Governance Analyst will support security compliance and governance activities for Blue Cross Blue Shield of Michigan. This role will focus heavily on HITRUST CSF assessments, IT controls testing, audit support, risk and compliance documentation, and governance reporting.
The analyst will evaluate business and IT operations against security frameworks, document assessment results, work with subject matter experts, identify control gaps and risks, and collaborate with cross-functional teams on remediation activities.
Key Responsibilities
Evaluate the design and operating effectiveness of Business and IT controls against the HITRUST CSF and identify areas for improvement.
Conduct interviews with subject matter experts, lead process walkthroughs, and document discussions and meeting outcomes.
Review evidence and documentation, perform detailed control testing, and document assessment results.
Analyze the root causes of control or compliance issues and recommend process improvements and risk mitigation strategies.
Collaborate with cross-functional teams to address identified risks and maintain compliance with HITRUST CSF requirements.
Develop clear, concise assessment documentation that meets HITRUST quality standards.
Prepare dashboards, KPIs, metrics, issue analysis, and assessment status reporting.
Use GRC tools to manage assessment documentation and remediation plans.
Serve as a HITRUST subject matter expert and provide guidance on compliance requirements.
Support internal and external audits, security assessments, and third-party reviews.
Assist with security governance initiatives and related projects.
Build effective relationships across Business, IT, Security, Risk, Compliance, and Audit teams.
Top Required Skills
4–5+ years of experience in IT compliance, IT assessments, IT controls, and/or IT audit, with a strong understanding of governance, risk, and compliance (GRC).
Strong knowledge of security and risk frameworks, particularly HITRUST CSF, along with frameworks and standards such as NIST CSF, ISO/IEC 27001, and COBIT.
Strong written and verbal communication skills, critical thinking, and the ability to work independently with minimal guidance.
Additional Required Experience
Experience coordinating and executing the audit lifecycle, including evidence collection and review, observation tracking, management responses, and auditor communication.
Experience testing IT controls across systems, databases, applications, and operating systems.
Strong problem-solving, analytical, and decision-making skills.
Ability to communicate technical, security, risk, and compliance findings effectively to different audiences.
Strong organizational skills with the ability to manage changing priorities and multiple assignments.
Ability to identify compliance gaps, understand associated risks, and develop practical recommendations for remediation.
Preferred Qualifications
Hands-on experience conducting IT audits, security assessments, or compliance assessments.
Experience working with Governance, Risk & Compliance processes and GRC tools.
Strong working knowledge of HITRUST CSF and NIST CSF.
Knowledge of additional security frameworks and standards, including ISO/IEC 27001 and COBIT.
Experience supporting audit remediation, control testing, compliance documentation, and security governance initiatives.
#LI-MC1
#INDPRO