Information Security Associate

Join us as we work to create a thriving ecosystem that delivers accessible, high-quality, and sustainable healthcare for all.

Role Summary:

The Information Security Associate helps support cybersecurity, IT risk management, and security audit activities that protect sensitive information and strengthen business operations. The position works across information security, systems administration, and project coordination to help identify risks, support controls, and improve security practices. This remote role is based in Pune, India and supports a distributed team environment. This role reports to the Director, Information Security.

Team Summary:

As the Information Security team at athenahealth, our mission is to keep the data we handle as secure as possible while enabling the business to be nimble and meet the needs of the customer. We partner with teams across the organization to reduce risk, support compliance, and strengthen the security of the systems and services that help care teams and patients.

Essential Job Responsibilities:

• Ensure Compliance - Work with new and existing athenahealth vendors to ensure initial and continued compliance with Information Security requirements. Review technical controls with vendors, document compliance and exceptions, and report out findings to athenahealth leadership.
• Engineering Experience - Ability to understand and apply technical concepts and apply them to recommendations around vendor onboarding and compliance.
• Systems Engineering - Ability to follow a strict change control process and implement changes and upgrades to essential security software, following documentation and escalation processes.
• Project planning and facilitation - Creation of Information Security related project plans that include deliverables, responsible parties, timelines, budgets, etc. for both athenahealth and 3rd party vendors who work with athenahealth. Frequently checking in with stakeholders (both internal and 3rd party) to ensure Information Security projects are on track, budget, etc.
• Reporting - Any exceptions to athenahealth Information Security policies by vendors must be communicated, tracked, and risk-managed on a regular basis.
• Process reviews - Ensure business stakeholders are periodically reviewing internal and vendor practices to ensure athenahealth is doing what we need to do on our end to remain compliant with all regulatory requirements.

Additional Job Responsibilities:

• Participate in team meetings, planning discussions, and knowledge-sharing sessions.
• Help maintain security-related trackers, logs, and documentation repositories.
• Support policy and procedure updates as security practices evolve.
• Contribute to continuous improvement efforts for security operations and risk processes.
• Assist with basic troubleshooting and coordination related to security tools or controls.
• Review recurring security metrics and operational reports as needed.
• Collaborate with colleagues across functions to support timely completion of assigned work.

Expected Education & Experience:

• Bachelor of Science in Computer Science or similar degree and/or applicable work experience such as IT Audit.
• 2+ years of experience managing technical projects. Working knowledge of technical concepts including virtual desktops, operating systems, networking, firewalls, and VPNs.
• 2+ years of experience managing external vendors from a compliance (particularly InfoSec) perspective.
• Strong written and verbal communication skills.
• Effective communication of technical concepts, suggestions, and concerns to stakeholders, vendors, and management.
• Risk management experience.
• Experience with Agile and Scrum project management concepts.
• Certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Agile and Scrum, etc.