Assess security risks associated with cloud-hosted solutions, SaaS applications, artificial intelligence, and emerging technologies.
Evaluate security controls against Texas Children's information security policies, standards, and applicable regulatory requirements.
Identify, document, and communicate cybersecurity risks, control deficiencies, and recommended risk mitigation measures.
Perform risk validation activities, review control attestations, and coordinate with responsible stakeholders to address outstanding security requirements.
Maintain accurate risk assessment records, findings, control evidence, and supporting documentation within ServiceNow GRC.
Collaborate with business owners, vendors, project managers, and technical teams to gather security information, clarify requirements, and communicate assessment findings.
Monitor assessment progress, outstanding documentation, and risk validation activities to support timely completion within established service-level expectations.
Identify material changes to existing vendor solutions that may require additional risk assessments or reassessments.
Support security exception management, risk acceptance processes, and documentation of identified control gaps.
Assist in developing and improving TPRM policies, procedures, assessment methodologies, reporting metrics, and operational processes.
Support internal and external audit activities by providing third-party risk assessment records and supporting evidence.
Required
H.S. Diploma or GED
5 years of experience in information services (IS), computer management, or IS networking experience, including at least three (3) years of information security experience.
Preferred
Experience in information security, cybersecurity risk assessments, third-party risk management, or Governance, Risk & Compliance (GRC).
Knowledge of cybersecurity frameworks and regulatory requirements, including NIST, ISO 27001, HIPAA, HITRUST, and PCI DSS.
Ability to interpret SOC 2 reports, security certifications, technical architecture diagrams, and vendor security documentation.
Understanding of cloud security, identity and access management, encryption, vulnerability management, and data protection principles.
Familiarity with ServiceNow GRC or comparable risk management platforms.
Strong analytical, problem-solving, communication, documentation, and stakeholder management skills.
Experience in healthcare or another highly regulated industry preferred.
Relevant professional certifications such as CRISC, CISM, CISSP, CISA, or Security+
