Security Analyst

About IHI

At Innovative Hematology, Inc. (IHI), we offer a future where people with rare blood disorders flourish. Our experts provide the highest quality comprehensive services and holistic care to patients with bleeding, clotting and other hematologic disorders, and to their families.

What You Will Do

We are seeking an experienced Security Analyst to join our Information Technology team. This role bridges tactical cybersecurity defense with regulatory compliance oversight to safeguard electronic Protected Health Information (e-PHI) and hybrid cloud systems.

Key responsibilities include administering the enterprise Vulnerability Management Program (VMP), serving as primary technical POC for our MSSP, triaging multi-source security alerts, managing workforce security awareness training, and coordinating compliance audit evidence (HIPAA, URAC, NIST CSF, PCI DSS) across four IT verticals: Applications, Data & Analytics, Cloud & DevOps, and IT Operations.

The Opportunity

1. Vulnerability Management Program (VMP) Administration

• Program Administration: Own and administer the day-to-day enterprise VMP across internal endpoints, servers, databases, and hybrid cloud infrastructure.
• Scanning & Analysis: Coordinate and oversee routine vulnerability scanning schedules, analyzing scan data and validating findings against threat intelligence and operational risk.
• Remediation Governance: Partner with IT Operations and Cloud & DevOps Engineering to track, prioritize, and validate remediation workflows for critical and high vulnerabilities within established SLAs.
• Exception Tracking: Document and track risk exceptions or remediation roadblocks in accordance with corporate policy.

2. Security Alert Monitoring, Incident Triage & MSSP Collaboration

• MSSP Point of Contact: Serve as the primary technical POC for the external MSSP, managing daily operational handoffs, alert escalations, and SLA performance.
• Multi-Tool Alert Triage: Monitor, analyze, and triage security alerts across endpoint detection and response (EDR), cloud workloads, identity providers, and email filtering systems.
• Phishing & Incident Response: Review, investigate, and remediate reported employee phishing submissions and suspected compromised credential alerts, escalating confirmed incidents in accordance with the Incident Response Plan.

3. Compliance Oversight & Audit Readiness

• Regulatory Framework Alignment: Evaluate technical, physical, and administrative safeguards against the HIPAA Security Rule (45 CFR Part 164), URAC accreditation standards (Core OPIN & RM modules), NIST CSF 2.0, and PCI DSS v4.0.
• Audit Evidence Coordination: Coordinate and gather technical compliance artifacts, audit evidence, and system configuration logs across IT verticals for external audits, annual HIPAA Risk assessments, and accreditation renewals.
• Access & Privilege Audits: Conduct routine internal audits of access control lists, privileged user activities, and third-party vendor access to ensure adherence to least privilege and minimum necessary principles.

4. Security Awareness Training & Human Risk Management

• Awareness Program Administration: Build, schedule, and administer monthly workforce security awareness training curricula and unannounced simulated phishing campaigns utilizing the enterprise LMS platform.
• Metrics & Consequence Enforcement: Track workforce completion rates, phish-prone percentages, and compliance metrics; collaborate with HR and Compliance to remediate chronic training delinquencies and phish failures in alignment with corporate policy.

5. Cross-Functional IT Vertical Collaboration

• IT Operations: Partner with team on endpoint hardening, Windows Server security baselines, and active directory hygiene.
• Cloud & DevOps: Collaborate with team on AWS security groups, IAM least privilege, container/pipeline security, and AWS network infrastructure.
• Application & Data: Interface with teams to review third-party software risks, database access governance, API integrations, and secure data handling baselines.

Requirements

• Minimum Associate's degree in related field, Bachelor’s degree preferred.

• Minimum 3 to 5 years of progressive experience in Cybersecurity operations, or a related field. Healthcare IT experience strongly preferred.
• Alternative to minimum: 6 to 8 years of progressive experience in Cybersecurity operations.
• Valid driver’s license and insured automobile required.
• All IHI employees are expected to enable multi-factor authentication via their personal smart phone/smart device in order to access IHI systems as a requirement of the role.

This position is open to residents of the State of Indiana, and requires routine presence at our Center in Indianapolis, IN. Frequency of on-site presence is dependent upon role and department needs.

Benefits

Why join our team?

IHI is a not-for-profit program based in Indianapolis and offers a competitive salary and benefit package.

IHI is the only federally designated comprehensive hemophilia program in Indiana and serves the entire state through services available in Indianapolis and at outreach clinics.

IHI is a leader in hemophilia care, education and clinical research and has a dedicated on-site multidisciplinary staff to ensure availability of a wide range of required services.

IHI participates in national and international clinical research, including new infusion products and therapies, investigation of long-term outcomes, and the impact of associated conditions. The IHTC research program provides patients access to new therapies, and an opportunity to improve care. Our center has more than 50 clinical research projects involving bleeding disorders, sickle cell disease, thrombosis and more.