Senior Information Security Risk Analyst

BlueCross BlueShield of Tennessee

. Serve as a technical subject matter expert in application security risk management .

Posted 10/9/2026full-timeRemote • Tennessee • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Application Security Risk Management, Governance, Risk, and Compliance (GRC), and the ability to translate technical findings into actionable business insights. Proficient in managing security policies, conducting risk assessments, and leading security awareness initiatives.

Highest-signal resume keywords

Application Security Risk ManagementGovernance, Risk, And Compliance (GRC)NIST FrameworkCISSP CertificationSecurity Vulnerability Assessment

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SAST/DAST ScanningRisk AssessmentVulnerability ManagementControl ValidationData GovernanceSecurity Policy ManagementIncident ManagementRegulatory ComplianceRisk Metrics AnalysisEvidence Collection

Soft Skills

Communication SkillsInterpersonal SkillsTime ManagementCollaborationRelationship Building

Tools & Technologies

AI-Enabled ToolsSecurity Awareness Training PlatformsRisk Management SoftwareCompliance Management ToolsPhishing Simulation Tools

Certifications & Qualifications

CISSPCRISCCISACISM

Industry Keywords

SOC 2NISTHIPAAData StewardshipAudit Activities

About the role

Key responsibilities & impact

Serve as a technical subject matter expert in application security risk management
Lead governance and oversight of the SAST/DAST application security scanning program
Assess security vulnerabilities and evaluate application and infrastructure scanning findings
Partner with application teams, incident management teams, and business stakeholders to prioritize and remediate risk
Maximize the value of the SAST/DAST platform and strengthen vulnerability management practices
Improve risk visibility and translate technical findings into actionable business risk insights
Support a high-visibility Data Governance initiative
Partner with business leaders, data owners, security, privacy, compliance, and technology teams
Establish governance standards, assess risk, monitor compliance, and strengthen data stewardship practices
Coordinate SOC 2 audit activities, including evidence collection, control validation, and auditor engagement
Maintain control documentation, mappings, and narratives
Oversee audit findings, remediation efforts, and issue closure
Create and update NIST System Security Plans (SSPs)
Design and manage security awareness training initiatives, phishing simulations, and targeted campaigns
Manage the lifecycle of security policies, standards, and procedures
Perform enterprise and third-party risk assessments, maintain risk registers, execute vendor risk assessments, and monitor remediation
Track vulnerability remediation against SLAs
Respond to RFPs and security questionnaires
Support initiatives across GRC areas and foster collaboration and shared accountability

Requirements

What you’ll need

Bachelor’s degree in a relevant field or an equivalent of four years of experience is required
5 years of professional experience in Information Security or related IT roles with security-related responsibilities
At least 2 years focused on Governance, Risk, and Compliance (GRC) functions
Experience leveraging AI-enabled tools to automate and enhance GRC processes preferred
One or more of CISSP, CRISC, CISA, or CISM certifications preferred
Ability to assess and document organizational risks, identify impacts, and recommend mitigation strategies
Ability to interpret and apply regulatory requirements and industry frameworks, including NIST, SOC 2, and HIPAA
Ability to analyze security, compliance, and risk metrics
Ability to communicate complex risk and compliance concepts to technical and non-technical stakeholders
Ability to collaborate across cross-functional teams
Exceptional time management skills
Excellent oral and written communication skills
Strong interpersonal and relationship-building skills
Ability to work with all levels of staff and management
Must be able to work Eastern Time business hours
Participation in on-call rotation is required for two weeks every 22 weeks
Sponsorship is not available for this role

Benefits

Comp & perks

Remote, work-from-home position
Employee worker type
Opportunity to influence enterprise-wide decisions and advance a mature Data Governance program