INFORMATION SYSTEMS TECH CONSULTANT - 76317

Executive Service

The Division of TennCare is dedicated to providing our employees with a hybrid work environment. All TennCare positions have a combination of work from home and work in the office, which varies by position, department, and business need. You may review the specific expectations with our hiring team.

Background Check:

This position requires a criminal background check. Therefore, you may be required to provide information about your criminal history in order to be considered for this position.

Who we are and what we do:

TennCare is Tennessee's managed care Medicaid program that provides health insurance coverage to certain groups of low-income individuals such as pregnant women, children, caretaker relatives of young children, older adults, and adults with physical disabilities. TennCare provides coverage for approximately 1.7 million Tennesseans and operates with an annual budget of approximately $14 billion. It is run by the Division of TennCare with oversight and some funding from the Centers for Medicare and Medicaid Services (CMS).

How you make a difference in this role:

TennCare's mission is to improve the lives of Tennesseans by providing high-quality cost-effective care. To fulfill that purpose, we equip each employee for active participation and empower teams to communicate and worked collaboratively to improve organizational processes in order to make a difference in the lives our members. Because of the positive impact TennCare has on the lives of the most vulnerable Tennesseans, TennCare employees report that their work provides them with a sense of meaning, purpose, and accomplishment. TennCare leadership understands that employees are our most valuable resource and ensures professional and leadership development are a priority for the agency.

Job Overview:

The State of Tennessee Division of TennCare is seeking a Risk Analyst to assist the Chief Information Security Officer in identifying, evaluating, and mitigating potential risks to enhance the security organization. The position will assist with the development and maturity of the TennCare Security risk management program, including Third-Party Risk Management (TPRM), Supply Chain Risk Management (SCRM), and emerging AI risk management, following federal and state regulatory requirements and best security practices within the healthcare business vertically. This position will be under the organizational structure of the Chief Information Security Officer.

Key Responsibilities:

• Perform security risk assessments, including identification, prioritization, and mitigation of information security risks, third-party risks, IT supply chain risks, and risks associated with Artificial Intelligence/Machine Language (AI/ML) deployments.
• Develop comprehensive risk management plans, monitor trends and compliance, including those for third-party vendors and AI systems, and provide strategic advice to help the Chief Information Security Officer make informed decisions and protect TennCare's best interests.
• Assist in the development of metrics to measure the efficiency and effectiveness of the risk management program, including key risk indicators (KRIs) for enterprise and AI-specific risks.
• Support the Third-Party Risk Management (TPRM) lifecycle, including vendor due diligence, contract review for security clauses, ongoing monitoring of vendor security posture, and management of Plan of Action & Milestones.
• Assist in strengthening AI risk management strategies, focusing on identifying potential ethical, privacy, security, and operational risks associated with AI technologies, and recommending appropriate controls.
• Work to establish and then support a Supply Chain Risk Management program that tracks risks that may impact the agencies' IT products or services.
• Partner with business and technology leaders and assist the CISO in representing the security team in executive discussions to align security with business goals, effectively communicating complex risk scenarios and mitigation strategies to diverse stakeholders.

Minimum Qualifications:

• Graduation from an accredited college or university with a bachelor's degree and experience equivalent to substantial (five or more years of) full-time relevant experience.

Desirable Qualifications

• 5+ years of experience in information security, with a strong focus on risk management, or as a technical lead in security-related projects.
• Bachelor's degree in information technology, Cybersecurity, Computer Science, or related discipline, or equivalent practical experience demonstrating a deep understanding of information security and risk principles.
• Demonstrable understanding of information security frameworks (e.g., NIST 800-53, NIST CSF, ISO 27001), regulatory requirements (e.g., ARC-AMPE, HIPAA), and risk assessment methodologies.
• Prior experience in healthcare or government.
• Professional certifications such as CISSP, CRISC (Certified in Risk and Information Systems Control), Certified Risk Manager (CRM), Certified Risk Management Professional (CRMP), or ISO 31000 Risk Management Certification are preferred.
• Experience with the National Institute of Standards & Technology (NIST) 800-53 or ARC-AMPE security and privacy frameworks, NIST Risk Management Framework (RMF), NIST AI Risk Management Framework, and/or ISO 31000 (Risk Management Standard).
• Prior experience in healthcare or government, with knowledge of relevant compliance mandates (e.g., HIPAA, CMS regulations).
• Experience with systems based on-premises, cloud-based (e.g., Azure, AWS, GCP), and hybrid architecture, including security controls and risk considerations for each environment.

Pursuant to the State of Tennessee's Workplace Discrimination and Harassment policy, the State is firmly committed to the principle of fair and equal employment opportunities for its citizens and strives to protect the rights and opportunities of all people to seek, obtain, and hold employment without being subjected to illegal discrimination and harassment in the workplace. It is the State's policy to provide an environment free of discrimination and harassment of an individual because of that person's race, color, national origin, age (40 and over), sex, pregnancy, religion, creed, disability, veteran's status or any other category protected by state and/or federal civil rights laws.