Technical Analyst

Summary/Objective

Medcurity is a fast-growing software and services company focused on helping healthcare organizations protect patient information. The Technical Analyst is responsible for delivering Medcurity's Security Risk Assessments (SRAs) and Network Vulnerability Assessments (NVAs) for healthcare clients. This includes guiding clients through the SRA process, conducting onsite and remote assessments, performing vulnerability scans, documenting findings, and supporting clients as they work through risk management after the assessment.

Position Type and Expected Hours of Work

This is a full-time position, reporting to the CEO, working at the Medcurity office Monday through Friday, 8:00AM to 5:00PM. Occasional evening and weekend work may be required, as job duties demand. Regular travel to client facilities, including overnight travel, will be required.

Responsibilities

Conduct HIPAA Security Risk Assessments for healthcare clients, guiding them through the assessment, interviewing key staff, and evaluating administrative, physical, and technical safeguards.

Conduct Network Vulnerability Assessments, including internal and external vulnerability scans, using Medcurity's approved tools and procedures, and only after written permission from the client has been obtained.

Perform onsite assessments at client facilities, including walkthroughs to evaluate physical safeguards.

Analyze assessment and scan results, prioritize risks, and prepare clear, accurate reports and remediation recommendations.

Present findings to clients and support them as they work through risk management and remediation following the assessment.

Coordinate with the Project Coordinator on scheduling, project timelines, and deliverables.

Use AI tools and the Medcurity platform to work efficiently, while verifying the accuracy of all findings and deliverables.

Stay current on HIPAA, NIST guidance, and cybersecurity threats and best practices relevant to healthcare.

Provide feedback to the product and development team on improvements to the Medcurity platform and assessment methods.

Complete other duties as assigned.

Qualifications

Foundational knowledge of networking, IT systems, and information security concepts.

Familiarity with vulnerability scanning tools and interpreting scan results.

Understanding of the HIPAA Security Rule and NIST frameworks is preferred, or a demonstrated ability to learn them quickly.

Strong written communication skills, with the ability to explain technical issues to non-technical healthcare leaders.

Attention to detail and sound judgment in handling sensitive client information.

Security or IT certifications, such as CompTIA Security+ or Network+, are a plus.

Valid driver's license and the ability to travel to client sites.

Work Environment

The employee works in an office setting and at client facilities, including hospitals and clinics.

Physical Demands

While performing the duties of this job, the employee is frequently required to sit, stand, walk, talk and hear. Onsite assessments require walking through client facilities. This position requires the ability to occasionally lift and carry office supplies and assessment equipment, up to 20 pounds.

Travel

Regular travel to client facilities, including overnight travel, will be required.

Confidentiality and Incidental Exposure to PHI

This role does not require, and is not authorized for, intentional access to, use of, disclosure of, or maintenance of Protected Health Information (PHI) or electronic Protected Health Information (ePHI). Any PHI or ePHI encountered while performing services for clients is incidental only and does not constitute authorization to access, use, or disclose it. Employees must limit any exposure to the minimum necessary, must not copy, record, or retain PHI or ePHI, and must securely delete or return any PHI or ePHI received, in accordance with Medcurity's HIPAA privacy and security policies. Any such exposure, and any suspected privacy or security incident, must be promptly reported to Medcurity's Privacy or Security Officer. All employees are expected to maintain the confidentiality of client information and comply with Medcurity's policies and applicable HIPAA requirements. Security risk assessments and network vulnerability assessments evaluate safeguards, systems, and configurations, not the content of patient records. Assessment notes, screenshots, and scan results must not capture PHI or ePHI.

AAP/EEO Statement

Medcurity is an equal opportunity employer and values diversity. All employment is decided on the basis of qualifications, merit and business need.

Other Duties

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.