Security & Compliance Analyst

About Us: The Center for the Study of Services (CSS) is a leader in healthcare survey research, based in Washington, DC. CSS is an established nonprofit organization with over 70 full-time staff. We provide valuable information to consumers through our brand Checkbook, helping them make informed decisions about their healthcare. Our organization is tight-knit and growing, prioritizing a positive work environment and rewarding hard work and results.

Position Overview: The Security & Compliance Analyst is a motivated and detail-oriented employee who is responsible for supporting the organization's information security and compliance initiatives. This role involves contributing to the organization's design, implementation and maintenance of security and compliance controls, monitoring and documenting the organization's compliance and security systems and providing clear documentation to external security and compliance auditors and assessors. The analyst works cross-functionally to ensure that the Organization maintains a strong security posture and compliance with relevant government and industry standards, including the HITRUST framework.

Salary Range: $80,000-$100,000 annually

Schedule: This is a hybrid position that is required to commute to our Washington, DC office 3 times per week. Our current required office days are Tuesdays, Thursdays, and a third day of your choice. Our office is conveniently located by both the Farragut North and Farragut West metro stations. Our standard core hours are 9:00 AM to 5:00 PM.

Qualifications:

• A bachelor's degree in information security, information systems or a related field.
• 1year of experience in information security, IT compliance, IT audit, or a related field required. (3+ years preferred)
• Working knowledge of the HIPAA Security and Privacy Rules and at least one control framework, such as HITRUST CSF, NIST SP 800-53, NIST CSF or ISO 27001.
• Moderate (or higher) understanding of security and privacy technologies to discuss access controls, logging, encryption, cloud/system configuration, endpoint protection, etc. with technical staff.
• Experience with risk assessment, documentation, and security policy/procedure development.
• Strong organizational skills and attention to detail.
• Clear, accurate writing, communication for clients, auditors and non-technical staff.
• One or more relevant certifications, such as CHPS, CIPP/US, CISA, HITRUST CCSFP, CompTIA Security+, Associate of ISC2, SSCP, CISSP, or other relevant certification. (preferred)
• Experience with a HITRUST r2 assessment or a similar third-party audit. (preferred)
• Familiarity with ARC-AMPE, state Medicaid security/privacy requirements, and/or other data privacy and security rule sets. (preferred)
• Experience with enterprise security, privacy, and compliance tooling, including interpreting findings and tracking remediation (e.g., DLP and data sensitivity labels, SIEM, Microsoft Defender/Intune endpoint compliance, Tenable/Nessus vulnerability management). (preferred)
• Experience reviewing and validating secure system configuration and gathering audit evidence across cloud and on-prem platforms (e.g., Microsoft 365/Entra ID, Azure, Windows Server/Active Directory, Cloudflare). (preferred)
• Experience using AI assistants for research, analysis, and other activities in security, compliance, or audit work, with reliable habits of verifying AI outputs. (preferred)

Why Work for CSS?

• Benefits: Medical, dental, vision, disability, and life insurance.
• Time Off: 12 paid holidays (6 static, 6 floating), 120 hours of vacation per year (accrued biweekly), and 40 hours of sick leave per year (accrued biweekly).
• Retirement: Employer 403b contribution after 2 years of service.
• Free Gym: Employees can access a free gym and bike parking less than a block from the office building.
• Additional Perks: Employee assistance program, employee discount program, pre-tax metro benefits.

Hiring Process:

• Round 1 - Applications are received and reviewed; qualified applicants are sent an online assessment.
• Round 2 - Assessment results are reviewed; qualified candidates are invited to a 1st interview.
• Round 3 - Interview results are reviewed; qualified candidates are invited to a final interview.
• Round 4 - Final interview results are reviewed; candidates are selected for reference checks. Once reference checks have cleared, candidates selected for a job offer will receive notification of their selection.

Applications received by 11/18/2026 will be prioritized.

Checkbook/CSS is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, gender, national origin, disability status, protected veteran status, or any other characteristic protected by law. Checkbook/CSS also proudly supports and encourages U.S. Veterans to apply for our job opportunities.

Please see the full job description for more details. No recruiters, please.

Join CSS and contribute to a welcoming and productive office environment. Apply today to be a key part of our team!