The Information Security GRC Analyst at eHealth is responsible for a range of critical functions, including assisting with internal and external audit engagements related to SOC2, HITRUST, and PCI-DSS, among others. You will gather and organize audit evidence, manage control and process libraries, assess and document risks, and work to implement effective security controls aligned with eHealth's policies and standards. This role is vital in driving compliance maturity and providing management with insightful metrics related to security processes.

To be considered for the Information Security GRC Analyst role at eHealth, candidates should possess a Bachelor's degree in Information Security, Information Systems, or a related field. Additionally, having 2+ years of experience in an Information Security audit setting, particularly with SOC2 and HITRUST, is essential. Strong communication skills and the ability to work collaboratively in a fast-paced environment will be vital for success in this role.

The Information Security GRC Analyst contributes significantly to eHealth's mission of providing transparent and trustworthy healthcare options. By assessing, evaluating, and recommending the implementation of security controls, you help safeguard sensitive information and ensure compliance with regulatory standards. Your work not only protects the organization but also fosters confidence in the services we deliver to consumers, enabling them to find affordable healthcare coverage.

At eHealth, the Information Security GRC Analyst can expect to join an open-minded, cohesive team that values collaboration and shared goals. Our culture promotes diversity and inclusion, recognizing that a diverse workforce drives stronger outcomes. The GRC team is passionate about problem-solving and is dedicated to supporting one another while fostering a risk-aware culture that empowers everyone to make significant contributions toward our mission.

eHealth offers a comprehensive benefits package for the Information Security GRC Analyst, including medical, dental, and vision coverage starting on your first day. Additional perks include a 401K plan with matching, tuition reimbursement, an employee stock purchase program, and ample paid time off. eHealth is committed to ensuring the well-being of its employees, making this an attractive opportunity for those looking to grow in a supportive environment.

Absolutely! SOC2 compliance is essential for information security analysts, especially at eHealth, where safeguarding consumer data is paramount. It's a framework that determines how a company manages customer data based on five trust services criteria: security, availability, processing integrity, confidentiality, and privacy. In your interview, you could discuss how you would identify control gaps and recommend strategies to align eHealth’s practices with SOC2 standards.

Assessing and documenting risks involves a systematic approach. You begin by identifying potential security threats, analyzing their impact and likelihood, and then categorizing these risks based on your findings. In your response, illustrate your experience with risk assessments, tools utilized, and how you effectively communicated the results to stakeholders, including recommendations for remediation.

To foster a risk-aware culture, I would advocate for ongoing security awareness training and regular phishing exercises for employees. I would highlight the importance of transparency in communication concerning risks while encouraging feedback and discussions regarding security practices. Demonstrating the practical implications of security and compliance can help embed these values into the company culture.

My experience with audits includes collaborating with cross-functional teams to prepare documentation and evidence for external auditors, ensuring compliance with frameworks like SOC2 and HITRUST. I would approach this question by discussing specific instances where I organized audit evidence, addressed findings, and worked closely with departments to remediate any identified gaps, showcasing a proactive approach.

To evaluate a vendor’s security posture, I would conduct thorough due diligence by reviewing their security policies, previous audit reports, and any compliance certifications they possess. I would also focus on their incident response capabilities and data handling procedures. Presenting a structured approach during your answer will demonstrate your analytical skills and ability to protect eHealth’s interests.

I am familiar with compliance frameworks such as NIST, HIPAA, and PCI-DSS, each of which serves different regulatory requirements. Discussing how these frameworks interconnect with eHealth's operations will illustrate your understanding of compliance needs. Be prepared to give examples of how you've previously implemented policies aligned with these frameworks in your work.

Managing audit evidence requires a meticulous approach. I would develop a structured system for organizing documentation, assigning responsibilities for evidence gathering, and ensuring timely submissions. Additionally, I would regularly update management on the status and readiness of the evidence to facilitate a smooth audit process. Highlighting past experiences will effectively convey your capabilities.

Handling conflicts with non-technical stakeholders requires patience and clarity. I would focus on translating technical jargon into understandable terms, building rapport, and listening to their concerns. I would emphasize the mutual goal of safeguarding eHealth’s interests, exploring compromises that address both security requirements and business needs. Demonstrating effective communication strategies in your response can be beneficial.

Essential metrics include risk assessment results, the status of remediation efforts, audit findings, and security training participation rates. I would also suggest reporting on the effectiveness of security controls, fraud incidents, and employee feedback on security awareness initiatives. This shows an understanding of what management needs to gauge compliance health effectively.

I want to work at eHealth because of your commitment to transparency and improvement in healthcare access. I resonate with eHealth’s values and mission, and I see this as a unique opportunity to apply my expertise in a meaningful way. In your answer, articulate personal motivations, such as a desire to contribute to impactful work and being part of a culture that emphasizes diversity and teamwork.