INFORMATION SYSTEMS TECH CONSULTANT - 82433

Executive Service

INFORMATION SYSTEMS TECH CONSULTANT

Division of TennCare

Information Systems (IS)

Nashville, TN

Minimum Annual Salary $79,320.00

Closing Date: 11/16/2026

Background Check:

This position requires a criminal background check. Therefore, you may be required to provide information about your criminal history in order to be considered for this position.

Who we are and what we do:

TennCare is Tennessee's Medicaid managed care program, serving over 1.4 million Tennesseans, including children, pregnant women, older adults, and individuals with disabilities. With an annual budget exceeding $19.2 billion, TennCare operates under the oversight of the Centers for Medicare and Medicaid Services (CMS).

TennCare's mission is to improve the lives of Tennesseans by providing high-quality, cost-effective care. At TennCare, we are driven by purpose. Our team is committed to improving outcomes for Tennessee's most vulnerable populations through innovation, integrity, and collaboration. Employees at TennCare report a deep sense of impact and satisfaction in their work. We prioritize people and process equally to create a workplace that values meaningful service, professional development, and shared success.

Job Overview:

TennCare compensation is equitable and will be based on education and experience for a qualified candidate in accordance with Department of Human Resources (DOHR) policy.

The Division of TennCare is dedicated to providing our employees with a hybrid work environment All TennCare positions have a combination of work from home and work in the office, which varies by position, department, and business need You may review the specific expectations with our hiring team

The State of Tennessee Division of TennCare is seeking a Risk Analyst to assist the Chief Information Security Officer in identifying, evaluating, and mitigating potential risks to enhance the security organization. The position will assist with the development and maturity of the TennCare Security risk management program, including Third-Party Risk Management (TPRM), Supply Chain Risk Management (SCRM), and emerging AI risk management, following federal and state regulatory requirements and best security practices within the healthcare business vertically. This position will be under the organizational structure of the Chief Information Security Officer.

Key Responsibilities:

• Perform security risk assessments, including identification, prioritization, and mitigation of information security risks, third-party risks, IT supply chain risks, and risks associated with Artificial Intelligence/Machine Language (AI/ML) deployments.-
• Develop comprehensive risk management plans, monitor trends and compliance, including those for third-party vendors and AI systems, and provide strategic advice to help the Chief Information Security Officer make informed decisions and protect TennCare's best interests.-
• Lead in the development of metrics to measure the efficiency and effectiveness of the risk management program, including key risk indicators (KRIs) for enterprise and AI-specific risks.- Oversee and manage the full Third-Party Risk Management (TPRM) lifecycle, including vendor due diligence, contract review for security clauses, ongoing monitoring of vendor security posture, and management of Plan of Action & Milestones.-
• Assist in strengthening AI risk management strategies, focusing on identifying potential ethical, privacy, security, and operational risks associated with AI technologies, and recommending appropriate controls.
• Establish, lead, and maintain a Supply Chain Risk Management program that tracks risks that may impact on the agencies' IT products or services.
• Partner with business and technology leaders and assist the CISO in representing the security team in executive discussions to align security with business goals, effectively communicating complex risk scenarios and mitigation strategies to diverse stakeholders.

Minimum Qualifications:

Graduation from an accredited college or university with a bachelor's degree and experience equivalent to substantial (five or more years of) full-time relevant experience.

Desirable Qualifications:

• 5+ years of experience in information security, with a strong focus on risk management, or as a technical lead in security-related projects.
• Bachelor's degree in information technology, Cybersecurity, Computer Science, or related discipline, or equivalent practical experience demonstrating a deep understanding of information security and risk principles.
• Proven experience leading risk programs, risk assessments, or enterprise risk initiatives.
• Experience collaborating with executive leadership and presenting complex risk topics to senior stakeholders.
• Demonstrable understanding of information security frameworks (e.g., NIST 800-53, NIST CSF, ISO 27001), regulatory requirements (e.g., ARC-AMPE, HIPAA), and risk assessment methodologies.
• Prior experience in healthcare or government, with knowledge of relevant compliance mandates (e.g., HIPAA, CMS regulations).
• Experience directing TPRM and SCRM programs preferred.
• Experience with systems based on premises, cloud-based (e.g., Azure, AWS, GCP), and hybrid architecture, including security controls and risk considerations for each environment.
• Experience with the National Institute of Standards & Technology (NIST) 800-53 or ARC-AMPE security and privacy frameworks, NIST Risk Management Framework (RMF), NIST AI Risk Management Framework, and/or ISO 31000 (Risk Management Standard).
• Professional certifications such as CISSP, CRISC (Certified in Risk and Information Systems Control), Certified Risk Manager (CRM), Certified Risk Management Professional (CRMP), or ISO 31000 Risk Management Certification are preferred.

Pursuant to the State of Tennessee's Workplace Discrimination and Harassment policy, the State is firmly committed to the principle of fair and equal employment opportunities for its citizens and strives to protect the rights and opportunities of all people to seek, obtain, and hold employment without being subjected to illegal discrimination and harassment in the workplace. It is the State's policy to provide an environment free of discrimination and harassment of an individual because of that person's race, color, national origin, age (40 and over), sex, pregnancy, religion, creed, disability, veteran's status or any other category protected by state and/or federal civil rights laws.