IT Security Analyst

PHYSICIANS MANAGEMENT GROUP

JOB DESCRIPTION

IT Security Analyst

REPORTS TO: Director of Information Systems

SCHEDULE: HYBRID

GENERAL SUMMARY: Maryland Primary Care Physicians, LLC (MPCP) is an independent, physician-owned network comprised of approximately 100 board certified providers across 10 locations, servicing 130,000 patients. MPCP's operations and financial management are performed by Physicians Management Group, LLC (PMG). The IT Security Analyst is responsible for safeguarding the organization's information systems, data, and infrastructure through proactive risk management, continuous monitoring, and compliance tracking. This role supports the Compliance Manager's formal risk analysis and risk register, contributes to the cybersecurity insurance renewal process, manages the core security toolset, and assists with incident response and breach risk determination. The Analyst also supports HIPAA-aligned access governance and vendor risk oversight for systems and third parties handling electronic protected health information (ePHI), partnering closely with the Director of Information Systems on policy development and overall security posture. The ideal candidate combines strong technical expertise with sound judgment, clear communication, and a proactive approach to identifying and mitigating security risks in a healthcare environment where ransomware, phishing, third-party/vendor compromise, and connected medical device (IoMT) threats are persistent and escalating. Responsibilities span the administrative, physical, and technical safeguards required by the HIPAA Security Rule. This list of duties is representative and not exhaustive; additional responsibilities may be assigned as business needs evolve.

SUPERVISION EXERCISED: None.

Typical Physical Demands: Requires sitting, some standing, stooping, and stretching. Occasionally may lift up to 30 pounds. Requires sufficient hand-eye coordination and manual dexterity to operate a keyboard, photocopier, telephone, calculator, and other office equipment. Requires normal range of hearing and eyesight to record, prepare, and communicate appropriate reports.

Typical Working Conditions: Work is typically performed in a corporate office / clinic setting and could involve contact with staff and/or patients. Hybrid schedule: three days per week on-site and two days remote. Occasional travel to affiliated MPCP locations as needed. On-call availability may be required to support security incident response.

Primary Duties/Responsibilities Include but not Limited to:

Cyber Insurance & Risk Management

1. Annually analyze changes to cyber insurance requirements and partner with the Director of IS to implement necessary policy, technical, or procedural changes
2. Complete annual attestation forms and applications required for cyber insurance renewal

Security Operations & Compliance Monitoring

1. Implement, monitor, and maintain security protocols and controls across the environment
2. Conduct regular user account audits, security group audits, and MFA compliance reviews
3. Coordinate periodic penetration testing and vulnerability assessments with an approved third-party vendor; track and remediate identified deficiencies
4. Manage the security vendor quoting and evaluation process
5. Support the formal HIPAA-aligned risk analysis, including contributing to the risk register and tracking of remediation owners and timelines
6. Verify and maintain encryption standards for ePHI at rest and in transit across endpoints, servers, and email
7. Perform regular review of information system activity – including audit logs, access reports, and security incident tracking reports – to detect unauthorized or anomalous access to ePHI (HIPAA 164.308(a)(1)(ii)(D))
8. Implement, maintain, and periodically test audit controls that record and examine activity in information systems that contain or use ePHI (HIPAA 164.312(b))

Systems & Tools Management

1. Manage and monitor remote monitoring and management (RMM) tools
2. Manage and monitor SIEM, antivirus, and EDR platforms, including alert triage, mitigation, and incident reporting
3. Support technical incident response activities, including investigation, containment, and coordination with the Compliance Manager on HIPAA breach risk determination and notification requirements
4. Administer and monitor the Proofpoint email security platform
5. Oversee Windows endpoint patch management and compliance reporting
6. Manage firewall rule adjustments as needed to support security requirements
7. Maintain a current inventory of networked, biomedical, and Internet-of-Medical-Things (IoMT) devices that create, store, or transmit ePHI; monitor them for known and exploited vulnerabilities and support network segmentation to isolate high-risk devices
8. Configure and verify technical access controls on systems containing ePHI, including unique user identification, automatic logoff, and emergency access procedures (HIPAA 164.312(a))
9. Verify that ePHI is backed up, that backups are encrypted and maintained in an offline or immutable form, and that restoration is regularly tested to ensure recovery from ransomware or destructive attacks

Policy & Compliance Support

1. Assist the Director of IS and Compliance Manager in developing and maintaining policies and procedures supporting the organization's cybersecurity posture
2. Support development of policies and procedures aligned with HIPAA regulatory requirements and risk management standards
3. Support security controls and audit processes for the Electronic Health Record (EHR) system and all systems containing ePHI
4. Support periodic access reviews for systems containing ePHI to ensure alignment with least-privilege and minimum-necessary access principles
5. Support vendor security risk assessments and due diligence for third parties with access to ePHI, in coordination with the Compliance Manager
6. Confirm that Business Associate Agreements (BAAs) are executed and current for all third parties that create, receive, maintain, or transmit ePHI, in coordination with the Compliance Manager
7. Support physical safeguards and device and media controls, including secure disposal, re-use, sanitization, and tracking of hardware and media containing ePHI (HIPAA 164.310)
8. Support timely provisioning and deprovisioning of access upon hire, role change, and termination, and assist with enforcement of the workforce security and sanction policies for security violations (HIPAA 164.308(a))
9. Support periodic technical and non-technical evaluations of the security program against the HIPAA Security Rule and maintain required security documentation and evidence for at least six years (HIPAA 164.308(a)(8), 164.316)

Business Continuity & Organizational Support

1. Participate in Business Continuity and Disaster Recovery planning, testing, and tabletop exercises
2. Monitor healthcare-specific threat intelligence (e.g., Health-ISAC, HHS HC3, and CISA advisories) and translate relevant alerts into defensive actions
3. Manage and monitor employee security awareness training programs and track completion/compliance
4. Research and attend relevant security conferences, training, and continuing education opportunities

Performance Requirements:

• Maintains cyber insurance attestations, applications, and required policy/control updates on schedule to keep the organization's coverage current and audit-ready
• Completes user account, security group, and MFA compliance audits on a regular, defined cadence, with findings documented and remediated within established timeframes
• Ensures penetration testing and vulnerability assessments are scheduled, completed, and tracked to closure, with identified deficiencies remediated according to risk-based timelines
• Contributes accurate, timely updates to the HIPAA risk register, including clear ownership and remediation timelines for each identified risk
• Reviews audit logs, access reports, and security incident tracking reports on a consistent basis, escalating unauthorized or anomalous ePHI access promptly
• Keeps SIEM, antivirus, EDR, and email security (Proofpoint) platforms properly configured and monitored, with alerts triaged and addressed within defined response windows
• Maintains Windows endpoint patch compliance at or above organizational targets
• Supports incident response activities with clear, timely documentation and coordination with the Compliance Manager on breach risk determination
• Maintains a current, accurate inventory of networked, biomedical, and IoMT devices, with known vulnerabilities tracked and addressed
• Verifies ePHI backup, encryption, and restoration testing occur on schedule, with results documented
• Supports policy, access review, and vendor risk assessment activities in a manner that meets HIPAA regulatory deadlines and audit expectations
• Maintains required security documentation and evidence in accordance with the six-year HIPAA retention requirement
• Participates actively in Business Continuity/Disaster Recovery planning, testing, and tabletop exercises, and maintains accurate supporting documentation and after-action reports
• Ensures employee security awareness training completion is tracked and reported accurately
• Demonstrates sound judgment and clear, professional communication when working across IT, compliance, and vendor stakeholders, and escalates issues appropriately and in a timely manner
• Stays current on cybersecurity threats and technologies through ongoing professional development

Knowledge, Skills & Abilities:

• Demonstrated verbal and written communication skills
• Demonstrated analytical and problem-solving abilities
• Ability to work collaboratively across IT and compliance functions while managing competing priorities
• Microsoft 365 security stack proficiency required, including Entra ID (Azure AD), Exchange Online, Microsoft Defender, Conditional Access, and Purview / Data Loss Prevention (DLP)
• Required scripting/automation experience, particularly PowerShell
• Working knowledge of vulnerability management, network segmentation, and backup/recovery practices

Education:

• Bachelor's degree in Computer Science, Information Technology, or related field required

Experience:

• Minimum 3 years of IT experience with a security focus
• Hands-on experience with SIEM and EDR platforms
• Experience supporting a healthcare EHR environment strongly preferred
• Working knowledge of HIPAA rules and regulations
• Familiarity with the HIPAA Security Rule safeguards (administrative, physical, and technical) and the Breach Notification Rule
• Exposure to medical device/IoMT security and network segmentation preferred

Certifications/License:

• CompTIA Security+ certification (or greater) required
• Preferred: an intermediate or healthcare-focused security certification such as CompTIA CySA+, GIAC GSEC, or CISSP

Alternative to Minimum Qualifications: None