Lead Analyst, Business Resiliency

Ensemble Health Partners is a provider of technology-enabled revenue cycle management solutions for health systems, hospitals, and affiliated physician groups. The Lead Analyst, Business Resiliency role supports business resiliency, enterprise risk management, and control architecture programs by developing continuity capabilities, risk governance, control frameworks, analytics, and executive reporting. The role partners with internal audit, finance, compliance, cybersecurity, IT, legal, operations, and other business leaders to strengthen organizational resilience and risk-informed decision-making.

Responsibilities:

• Partner with the Director, Enterprise Risk Management & Business Resiliency to develop and execute the long-term strategy for Enterprise Resiliency, translating organizational objectives into scalable, sustainable capabilities that strengthen operational resilience while maintaining administrative efficiency and cost-effectiveness
• Design, implement, and continuously mature business resiliency programs, frameworks, governance processes, and operating models across business operations, technology, applications, vendors, customers, and critical services, ensuring increasing program depth and integration can be sustained without disproportionate resource investment
• Identify, evaluate, and implement appropriate uses of artificial intelligence, automation, analytics, and emerging technologies to improve the efficiency, effectiveness, quality, scalability, and reporting capabilities of resiliency, risk, and control programs while maintaining appropriate governance and oversight
• Foster a culture of resiliency across the enterprise by partnering with leaders to embed resilience, preparedness, dependency management, and recovery considerations into strategic planning, operational decision-making, project delivery, vendor oversight, and day-to-day business activities, while serving as a strategic advisor and thought partner who continuously drives measurable, value-added program improvements
• Partner with the Director, Enterprise Risk Management & Business Resiliency to define and execute the long-term vision, framework, governance model, and operating strategy for Enterprise Risk Management, ensuring the program remains scalable, decision-oriented, and aligned with organizational objectives, growth, and emerging risks
• Lead the continuous maturation of Ensemble's ERM capabilities by advancing risk methodologies, taxonomies, analytics, reporting, and governance processes while leveraging Optro RiskOversight, automation, artificial intelligence, and other technologies to improve efficiency, transparency, adoption, and executive insight
• Support the enterprise risk assessment process by facilitating executive engagement, identifying strategic and emerging risks, challenging assumptions, strengthening risk ownership, and translating risk intelligence into actionable recommendations that support leadership decision-making, internal audit planning, and Board oversight
• Develop meaningful risk metrics, key risk indicators, dashboards, scenario analyses, and executive communications that enhance risk awareness, foster a strong risk culture, and enable leaders and the Board to proactively monitor, understand, and respond to evolving business, operational, technology, regulatory, and third-party risks
• Partner with the Director, Enterprise Risk Management & Business Resiliency to establish and mature Ensemble's enterprise control architecture strategy, creating a scalable, integrated control environment that supports risk management, compliance, audit, operational resilience, and executive decision-making across the organization
• Design and govern the enterprise controls framework, including control taxonomy, standards, ownership models, evidence requirements, lifecycle management, and cross-framework mappings, while promoting standardization, simplification, and sustainable administration as the program expands in scope and maturity
• Analyze relationships between risks, controls, findings, obligations, and assurance activities to identify coverage gaps, redundancies, inefficiencies, emerging control needs, and opportunities to strengthen risk mitigation while reducing unnecessary control burden across the enterprise
• Leverage data analytics, automation, artificial intelligence, and enabling technologies to improve control visibility, reporting, monitoring, and effectiveness, developing meaningful dashboards, coverage metrics, heat maps, and executive-level insights that support proactive governance and continuous improvement
• Serve as a trusted advisor and strategic partner to leaders across Operations, Internal Audit, Finance, Business Resiliency, Cybersecurity, IT, Third-Party Risk Management, Compliance, Privacy, Legal, and other functions, fostering alignment between enterprise risk, resiliency, control, governance, and assurance activities to support informed decision-making and organizational objectives
• Partner with business and functional leaders to embed resiliency principles into operational processes, technology initiatives, vendor oversight, customer commitments, strategic planning, and major business changes, helping cultivate a sustainable culture of resilience and shared accountability across the enterprise
• Translate audit findings, risk assessments, business continuity exercises, recovery planning activities, compliance obligations, management action plans, and control requirements into integrated risk, resiliency, and control improvement strategies that strengthen organizational preparedness and risk mitigation capabilities
• Advise leaders, risk owners, and process owners on risk management, business resiliency, control design, governance, evidence expectations, and control-to-risk alignment, serving as a subject matter expert and strategic thought partner on enterprise initiatives, transformation efforts, and special projects while continuously identifying opportunities for efficiency, simplification, automation, and value creation

Requirements:

• Analytical Judgment: Synthesizes complex risk, control, evidence, audit, and KRI information to advise leaders on implications, gaps, and mitigation strategies
• Systems Thinking: Connects risks, controls, processes, technologies, and assurance activities into durable governance models
• Collaboration & Influence: Builds alignment across risk, audit, finance, technology, compliance, legal, and operational stakeholders without direct authority
• Execution & Accountability: Drives cross-functional initiatives from design through adoption, with clear ownership, timelines, and measurable outcomes
• Business Resiliency Judgment: Applies continuity, crisis management, disaster recovery, and operational resilience practices to strengthen preparedness and recovery capabilities
• Communication: Translates risk, resiliency, and control concepts into clear guidance for executives, managers, and assurance partners
• CBCP, MBCI, CRISC, RIMS-CRMP, CIA, CISA, CRCR - if not already obtained, working toward a certification
• Willingness to obtain a certification within 9 months
• At least 6 years of progressive experience in Business Resiliency and Enterprise risk management in a rapid growth environment with at least two years at the Manager level
• At least 2 years' experience managing people
• Bachelor's degree or Equivalent Experience ( Health Information Management; Health Information Systems; Risk Management; Accounting; Auditing; Finance; Healthcare Revenue Cycle; or related)
• Demonstrated expertise in Business Resiliency, Operational Resilience, Enterprise Risk Management, Internal Controls, Governance, and Assurance disciplines, with the ability to integrate these capabilities into a cohesive enterprise-wide strategy that supports organizational objectives, operational excellence, and sustainable growth
• Proven ability to think strategically while executing pragmatically, including designing scalable governance frameworks, operating models, and risk and resiliency capabilities that can mature across business functions, technology, vendors, customers, and regulatory requirements without creating disproportionate administrative burden or cost
• Strong analytical, facilitation, and stakeholder engagement skills, with the ability to influence outcomes, build consensus, challenge assumptions, and drive meaningful change across all levels of the organization without direct authority
• Exceptional executive communication and relationship management skills, including the ability to translate complex risk, resiliency, control, technology, and emerging threat concepts into concise, actionable insights that support informed decision-making by senior leadership, executive committees, and the Board of Directors
• Demonstrated ability to identify, evaluate, and apply artificial intelligence, automation, analytics, and emerging technologies to improve the efficiency, effectiveness, scalability, quality, and sustainability of risk, resiliency, governance, and control programs while maintaining appropriate oversight and governance
• Experience building and advancing organizational cultures that promote risk awareness, resiliency, accountability, preparedness, continuous improvement, and shared ownership of enterprise objectives and outcomes
• Working knowledge of leading governance, risk, compliance, resiliency, cybersecurity, and control frameworks, including COSO ERM, COSO Internal Control – Integrated Framework, ISO 31000, ISO 22301, NIST CSF, NIST AI RMF, HITRUST CSF, ISO 27001, SOC 1 / SOC 2, HIPAA Security & Privacy Rules, PCI DSS, and related industry standards
• Hands-on experience with GRC, resiliency, or risk management platforms (e.g., Optro RiskOversight & CrossComply, AuditBoard, ServiceNow IRM/GRC, Archer, Workiva, MetricStream, Fusion, or comparable solutions), coupled with strong data analysis, reporting, Microsoft 365, SharePoint, and AI-assisted productivity capabilities
• Due to business, operational, payroll, and regulatory requirements, this position is limited to individuals who reside and are authorized to work within the United States. Applications generated from outside the United States will not be considered. Individuals may reapply when located within the United States