Information Security Analyst

Job Title: Information Security Analyst Healthcare IT Compliance
Location: Bengaluru, India
Experience: 3–6 years
Department: Cyber Security & IT Compliance (Healthcare Practice)

About the Role

We are looking for an Information Security Analyst to support our security and compliance programs for healthcare and cloud-based offerings. The role focuses on maintaining compliance with HIPAA, ISO 27001, FedRAMP, and NIST SP 800-53, supporting audits and continuous monitoring, and contributing to vulnerability management and security testing activities.

Key Responsibilities

• Support implementation and ongoing maintenance of security controls aligned with ISO 27001, NIST SP 800-53, FedRAMP, and HIPAA Security and Privacy Rules.
• Coordinate internal and external audits, including evidence collection, control testing, and tracking of findings through to closure.
• Support FedRAMP Continuous Monitoring (ConMon) activities, including monthly vulnerability scan reviews, POA&M updates, and deviation requests.
• Maintain and update security documentation such as policies, procedures, SSPs, risk registers, and control matrices.
• Conduct risk assessments, gap assessments, and third-party/vendor security reviews.
• Assist in vulnerability assessments and penetration testing (VAPT) coordination, including scoping, triaging findings, and tracking remediation with engineering teams.
• Review vulnerability scan results (e.g., Veracode, Qualys) and prioritise remediation based on risk.
• Support the FedRAMP CR26 transition, including scope assessment, gap analysis against current authorization packages, and alignment of controls and processes to the new requirements.
• Develop and maintain machine-readable authorization packages (SSP, SAP, SAR, POA&M) in OSCAL format, and support conversion of existing documentation into OSCAL.
• Implement and maintain automated validation of Key Security Indicators (KSIs), mapping KSIs to underlying NIST SP 800-53 controls and technical evidence sources.
• Build and maintain automated evidence collection from cloud and security tooling (e.g., AWS Config, Security Hub, CloudTrail, vulnerability scanners) to support continuous, near-real-time compliance reporting.
• Work with DevOps and engineering teams to embed control checks into CI/CD pipelines and infrastructure-as-code workflows.
• Support HIPAA risk analysis, PHI data flow reviews, and breach/incident assessment.

Required Skills and Experience

• 3–6 years of experience in information security, GRC, or IT compliance.
• Hands-on working knowledge of ISO 27001:2022, NIST SP 800-53 Rev 5, and HIPAA.
• Exposure to FedRAMP authorization or ConMon processes.
• Working knowledge of FedRAMP 20x / CR26 concepts, including KSIs and machine-readable compliance.
• Hands-on experience or strong familiarity with OSCAL (JSON/XML/YAML) and related tooling such as Compliance Trestle or the NIST OSCAL CLI.
• Understanding of cloud security concepts, preferably AWS.
• Basic to intermediate experience in network security and VAPT, including vulnerability scanning tools and understanding of common vulnerabilities (OWASP Top 10, CVSS scoring).
• Familiarity with security controls such as IAM, logging and monitoring, encryption, and configuration management.
• Strong documentation, analytical, and stakeholder communication skills.

Preferred Qualifications

• Certifications such as ISO 27001 Lead Auditor/Implementer, CompTIA Security+, CEH, CISA, or AWS Security Specialty.
• Experience with GRC tools and ticketing platforms (e.g., Jira, ServiceNow).
• Exposure to PCI DSS or HITRUST is an advantage.

Education

Bachelor’s degree in Computer Science, Information Technology, Electronics, or a related field.