Info Sec Analyst

Blue Cross & Blue Shield of Rhode Island is seeking an innovative and detail-oriented security professional to join its Information Security team. This role is responsible for assessing, monitoring, and mitigating security, privacy, compliance, and operational risks associated with third-party vendors, delegates, and AI-enabled solutions. The successful candidate will support the organization's Enhanced Vendor Oversight (EVO) and AI governance programs by conducting risk assessments, reviewing vendor controls and AI use cases, communicating risk findings to stakeholders, supporting remediation efforts, and helping ensure alignment with organizational policies, regulatory requirements, and industry best practices.

Responsibilities

Conduct security, privacy, and risk assessments of third-party vendors, delegates, and AI-enabled solutions to identify potential risks and vulnerabilities; Collaborate with business and technology stakeholders to ensure third-party and AI-related practices align with organizational policies, regulatory requirements, and governance standards; Review and analyze security attestations, certifications, and supporting documentation (e.g., SOC 2, HITRUST, ISO certifications) to assess vendor risk; Maintain vendor and AI risk inventories, portfolios, engagement records, risk assessments, and related documentation; Evaluate third-party and AI vendor controls related to cybersecurity, data protection, privacy, regulatory compliance, model governance, and secure development practices; Provide risk mitigation recommendations and support remediation activities to improve vendor and AI security posture; Support implementation and monitoring of Enhanced Vendor Oversight (EVO), AI governance requirements, standards, and risk management processes; Stay informed on emerging threats, industry best practices, regulatory developments, and evolving risks related to third-party security, AI, and technology governance

Requirements

Bachelor's degree in Cybersecurity, Information Security, Information Technology, Risk Management, or similar areas of study from an accredited college or university (preferred); or a high school diploma combined with strong industry experience and/or currently enrolled in a bachelor's degree program; 3+ years of relevant industry experience ideally focused in vendor management, third-party risk management, or related enhanced vendor oversight tasks

Nice to have

Experience evaluating technology, cybersecurity, privacy, or third-party risks associated with Artificial Intelligence (AI), machine learning, generative AI, or emerging technologies; Relevant certifications such as CISSP, CISA, CRISC, or equivalent; Advanced knowledge of Microsoft Office including Outlook, Word, Excel, and PowerPoint; Understanding of AI, ML, Generative AI, and related technology risks; Knowledge of AI governance frameworks and industry best practices; Familiarity with NIST AI RMF; Familiarity with ISO/IEC 42001 AIMS; Understanding of AI-related regulatory, privacy, security, and ethical considerations; Experience reviewing AI vendor security questionnaires, AI governance documentation, AI model risk documentation, or AI-related control environments; Strong analytical and organizational skills; Effective oral and written communication skills; Self-driven team player; Ability to work independently and as part of a team; Knowledge of healthcare industry regulations and standards

Benefits

Flexible work arrangements including remote and hybrid opportunities; Paid time off; Tuition reimbursement; Student-loan repayment assistance; Health, dental, and vision insurance; Programs supporting mental health and well-being; Competitive pay; Bonuses; Investment plans; Additional paid time to volunteer