Skip To Content

Associate Risk & Compliance Analyst

Highmark Health

  • Company Hignmark Health
  • Home, NY
  • Finance
  • Full time
  • Day (United States of America)

Company :

Highmark Health

Job Description : 


This job works collaboratively to support of all risk and compliance assessment activities of Highmark Health across a broad range of frameworks including NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO, etc.  The incumbent will partner with the organizational risk and business partners, the technology organization, and global delivery teams to meet Highmark Health’s mission requirements in a manner consistent with the enterprise risk appetite.  This individual must have a proactive mindset and approach, and feel comfortable working in a highly matrixed environment.              


  • Assist with scheduling, delivery, and follow-ups with internal and external contacts to ensure risk questionnaires and other risk assessments are completed timely in order to ensure compliance requirements are met across the Enterprise. Receives training and mentoring on multi-faceted supplier engagements, platform customer dependencies, and the review and interpretation of less-complex contract agreements.
  • Assist with the completion of risk assessment activities according to a broad range of frameworks including NIST, HITRUST, PCI, HIPAA, SOC, MAR, CMS, JCAHO,  in order to identify, assess, prioritize, evaluate and address  compliance, financial, information security, privacy, and other areas of risk. Prepares work papers, reporting templates and other management reporting deliverables.  Prepare all work paper and supporting documentation evidence according to audit quality standards in a consistent manner.
  • Follows project plans and audit programs to support risk assessment and decisioning processes in coordination with business owners and other stakeholders within task-based budgets.  Assists with preparing materials and communicating assessment results during collaborative sessions  to align risk management objectives, third party risk management practices and procedures.
  • Follow departmental desk-level procedures, risk assessment methodology, assessment procedures, questionnaires, training, etc. and assists with documenting activities which demonstrate and support compliance with departmental metrics, performance of internal control activities, awareness of contractual obligations, regulatory requirements, and assistance with responding to customer inquiries / audits. 
  • Assist with distributing and gathering inherent risk assessment results to/from business owners and assists with documentation of the stratification of supplier engagement risks.  Assists with the development of assurance plans (e.g., on-site audit, contract review, financials assessment, purchasing data analysis) to address relevant risk areas and to ensure proper controls are implemented.  Gathers, organizes, researches and assists with review and interpretation of authoritative guidance and assists with research and performing qualitative and quantitative impact assessments based on regulatory and contractual requirements; assists with conducting additional information gathering and risk assessments with suppliers as-needed; documents and assists with reporting results
  • Assist with documentation and validation of complex data flow/ information sharing activities, customer integration, and information safeguards into simplified and high-level terminology and/or process/data flows.  Maintaining enterprise risk management reporting dashboards in RSA Archer applications in order to keep information complete, accurate, and current.  Prepares and assists with the delivery of  assurance reports to management. 
  • Interface with business areas, technical staff, project teams, and third parties to execute cross-functional third party risk assurance projects and to communicate findings and remediation plans.  Assist with consultation and supporting activities throughout assurance engagements that support the enterprise's strategic direction, core operations, etc.
  • Assist with providing input and consultation on risk and assurance reporting and regulatory or contractual requirements.  Assist with consultations with other areas (e.g., Procurement, Privacy, Information Security, Legal) throughout the assessment and decisioning lifecycle along with internal business and relevant external partners.  
  • Other duties as assigned or requested.



  • Bachelor's Degree in Accounting, Finance, Business Administration/Management, Information Technology, Pre-Law, or related field

Substitution s

  • 6 years of related and progressive experience in lieu of Bachelor's degree


  • Master's Degree in Accounting, Finance, Business Administration/Management, Information Technology, Pre-Law, or related field



  • None


  • 1 years in Audit and Compliance OR  Business Process Design OR  Project Management



  • None

Preferred (any of the following)

  • Certified Public Accountant (CPA)
  • Certified Information Systems Analyst (CISA)
  • Certified Information Privacy Professional (CIPP)
  • Certified Information Systems Security Professional (CISSP)


  • Demonstrate expert knowledge of business and technology processes, risk and control frameworks, and assessment methodologies, particularly as applied to healthcare (payer and provider) business processes.
  • Knowledge of relevant regulatory guidelines, vendor management, sourcing and procurement, and completing assessments of vendors 
  • Excellent resource and project planning capabilities, decision making skills, history of results-oriented delivery, and effective team building across a cross-campus and diverse team of management and staff. 
  • Strong written and verbal communication skills for diverse audiences (senior management, board, peer, and team). 
  • Strong relationship building skills and ability to influence with and without authority in a matrixed organization. 
  • Developed leadership qualities with an ability to motivate and inspire a group of individuals to achieve superior results. 
  • High capacity to think analytically, interpret information / observations, apply judgment and make effective, strategic decisions.

Language (Other than English):


Travel Requirement:

0% - 25%


Position Type


Teaches / trains others regularly


Travel regularly from the office to various work sites or from site-to-site


Works primarily out-of-the office selling products/services (sales employees)


Physical work site required


Lifting: up to 10 pounds


Lifting: 10 to 25 pounds


Lifting: 25 to 50 pounds


Disclaimer: The job description has been designed to indicate the general nature and essential duties and responsibilities of work performed by employees within this job title. It may not contain a comprehensive inventory of all duties, responsibilities, and qualifications required of employees to do this job.

Compliance Requirement : This job adheres to the ethical and legal standards and behavioral expectations as set forth in the code of business conduct and company policies.

As a component of job responsibilities, employees may have access to covered information, cardholder data, or other confidential customer information that must be protected at all times.  In connection with this, all employees must comply with both the Health Insurance Portability Accountability Act of 1996 (HIPAA) as described in the Notice of Privacy Practices and Privacy Policies and Procedures as well as all data security guidelines established within the Company’s Handbook of Privacy Policies and Practices and Information Security Policy. 

Furthermore, it is every employee’s responsibility to comply with the company’s Code of Business Conduct. This includes but is not limited to adherence to applicable federal and state laws, rules, and regulations as well as company policies and training requirements.

Pay Range Minimum:


Pay Range Maximum:


Base pay is determined by a variety of factors including a candidate’s qualifications, experience, and expected contributions, as well as internal peer equity, market, and business considerations.  The displayed salary range does not reflect any geographic differential Highmark may apply for certain locations based upon comparative markets.

Highmark Health and its affiliates prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, age, religion, sex, national origin, sexual orientation/gender identity or any other category protected by applicable federal, state or local law. Highmark Health and its affiliates take affirmative action to employ and advance in employment individuals without regard to race, color, age, religion, sex, national origin, sexual orientation/gender identity, protected veteran status or disability. 

EEO is The Law

Equal Opportunity Employer Minorities/Women/Protected Veterans/Disabled/Sexual Orientation/Gender Identity ( )

We endeavor to make this site accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact number below.

For accommodation requests, please contact HR Services Online at

California Consumer Privacy Act Employees, Contractors, and Applicants Notice

Thumbnail Join Talent Community@2X

Connect with a career that’s right for you.

Introduce yourself and we'll get in touch monthly to share career insights and company news.

Join Our Talent Community