SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Innovaccer is seeking a Security Engineer II specializing in Governance, Risk & Compliance (GRC) to support the Cyber Security team across internal, customer, commercial, and public-sector environments. This role encompasses a broad range of security and compliance activities critical to healthcare and federal operations.
Key Responsibilities:
- Respond to RFPs and security questionnaires, coordinating with RFP, Legal, Privacy, Product, Engineering, and IT teams on security exhibits, BAA/MSA/DPA queries, and customer follow-ups
- Perform risk assessments, business impact analysis (BIA), business continuity/disaster recovery planning, and tabletop exercises
- Analyze and update security, privacy, and compliance policies, procedures, and documentation
- Support implementation of privacy, data protection, and security controls
- Drive vendor risk assessment and third-party risk management activities
- Support internal and external audits including SOC 2 Type II, HIPAA, HITRUST, ISO 27001, and other applicable frameworks
- Support FedRAMP, GovRAMP/StateRAMP, and public-sector compliance initiatives
- Support control implementation and assessment aligned with NIST SP 800-53
- Maintain and track Plans of Action and Milestones (POA&M), remediation activities, risk registers, and control gaps
- Support continuous monitoring (ConMon) activities and audit/assessment evidence collection
- Coordinate with internal teams for gathering, validating, and presenting audit and compliance evidence
- Support third-party assessments and coordination with 3PAOs and external auditors
- Identify control gaps/weaknesses and formulate action plans
- Support security and privacy requirements across US healthcare, federal/state, and Middle-East regulations
- Support AI governance and security initiatives, including ISO 42001 and NIST AI RMF
Requirements:
- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or related field (preferred)
- 4–6 years of prior experience in Information Security Risk & Compliance / GRC
- Hands-on experience with implementation or assessment of HIPAA, SOC 2 Type II, ISO 27001, HITRUST, or similar security and compliance frameworks
- Strong understanding of security, privacy, risk, governance, and compliance controls
- Experience with vendor risk assessment and third-party risk management
- Experience responding to RFPs, security questionnaires, customer assessments, and legal/security exhibits
- Experience working with internal teams for audit, compliance, and evidence collection activities
- Familiarity with US federal and state security and compliance frameworks, including FedRAMP, GovRAMP/StateRAMP, NIST SP 800-53, MARS-E, and ARC-AMPE
- Understanding of POA&M, continuous monitoring (ConMon), security assessments, authorization processes, SSP, and 3PAO assessment activities
- Familiarity with GDPR, HITECH, US state privacy/security regulations, and Middle-East privacy regulations including PDPL
- Familiarity with cloud environments such as AWS, Azure, and/or GCP
- Strong documentation, analytical, communication, and stakeholder-management skills
- Ability to work independently, multitask, prioritize, and manage time effectively
- Effective collaboration and communication with technical and non-technical stakeholders
- Willingness to work with teams and customers across US and Middle-East time zones
- Good to have: ISO 27001 LA/LI, CISA, CRISC, or other relevant security and compliance certifications
