Job Description

Company :

Highmark Health

Job Description :

Applicants must be authorized to work in the U.S. independently. At this time, we do not offer visa sponsorship for this role.

The Summer 2027 Cyber Risk Management Analyst Undergraduate Internship provides students with an opportunity to gain practical, hands-on experience identifying, assessing, and managing cybersecurity and information technology risks within a large, complex healthcare technology environment. This internship is designed to develop the next generation of cybersecurity professionals through direct exposure to cyber risk assessments, security controls, compliance frameworks, risk mitigation, secure solution design, and emerging technology risks.

As a member of the Cyber Risk Management team, the intern will work alongside cybersecurity professionals, security architects, technology teams, and business stakeholders to support information risk assessments and help evaluate how effectively security controls protect enterprise systems, applications, and sensitive information. Participants will gain valuable experience understanding threats and vulnerabilities, evaluating the likelihood and potential impact of cyber risks, documenting assessment findings, and supporting appropriate risk treatment strategies.

The program provides hands-on exposure to industry cybersecurity and compliance frameworks, including HITRUST CSF, NIST, PCI-DSS, and ISO 27001, as well as secure software development lifecycle practices. Interns will also gain insight into how cybersecurity requirements are incorporated into technology projects, solution designs, and enterprise architecture decisions.

In addition to foundational cyber risk management activities, the intern will gain exposure to emerging areas such as secure AI adoption, AI model lifecycle security, data privacy, third-party AI and vendor risk, and automation within cyber risk management. Participants may explore opportunities to use AI and automation to enhance risk analysis, control validation, reporting, and cybersecurity metrics.

Typical responsibilities include supporting risk assessments, gathering and analyzing evidence, conducting stakeholder interviews, assisting with risk scoring, maintaining risk registers, monitoring remediation activities, supporting cybersecurity compliance documentation, and preparing presentations and recommendations for technical and business audiences. Through mentorship, cross-functional collaboration, and real-world project experience, interns will strengthen their cybersecurity, analytical, communication, and risk management skills.

SUMMARY OF JOB RESPONSIBILITIES

This job has the goal of providing the opportunity to acquire practical experience through direct exposure to the related business line(s) and to develop the next generation of diverse business professionals. To that end, the program will provide hands-on training and experience in the business line, expose the various career opportunities in the business line and related areas, and prepare participants for positions in the business.

Typical responsibilities include, providing services to the day-to-day operating objectives of the assigned area, participating in projects and programs appropriate to the needs of the assigned area, participating in the planning and implementation of projects and initiatives, conducting research and reporting including recommendations or proposals for action.

REQUIRED QUALIFICATIONS

• Full or part-time enrollment in an accredited college or university baccalaureate program.

REQUIRED QUALIFICATIONS

• Currently pursuing a degree in Cybersecurity, Information Security, Computer Science, Information Technology, Information Systems, or a related technical discipline.
• Knowledge of or academic exposure to the HITRUST CSF and NIST cybersecurity frameworks.
• Knowledge of or familiarity with NIST risk assessment methodologies.

ESSENTIAL JOB FUNCTIONS

1. Communicate effectively while interacting directly with colleagues, clientele, and/or other internal or external constituencies in the planning of assignments and the resolution of day-to-day operational problems.
2. Under supervision, provide entry-level professional services as appropriate to the day-to-day operating objectives of the area. Receives guidance, training, and mentoring from senior personnel in planning and carrying out activities and assignments.
3. Undertake and/or participates in projects and programs designed to develop professional skills and expertise appropriate to the needs of the organization.
4. Participate in the planning and implementation of unit projects and initiatives within area of expertise and ability.
5. As specifically requested by management, conduct research and reporting inclusive of recommendations or alternative proposals for action.
6. Undertake related studies or enrichment programs as appropriate to the specific objectives of the operating unit.
7. Perform miscellaneous job-related duties as assigned.

Disclaimer: The job description has been designed to indicate the general nature and essential duties and responsibilities of work performed by employees within this job title. It may not contain a comprehensive inventory of all duties, responsibilities, and qualifications required of employees to do this job.

Compliance Requirement: This position adheres to the ethical and legal standards and behavioral expectations as set forth in the code of business conduct and company policies

As a component of job responsibilities, employees may have access to covered information, cardholder data, or other confidential customer information that must be protected at all times. In connection with this, all employees must comply with both the Health Insurance Portability Accountability Act of 1996 (HIPAA) as described in the Notice of Privacy Practices and Privacy Policies and Procedures as well as all data security guidelines established within the Company’s Handbook of Privacy Policies and Practices and Information Security Policy. Furthermore, it is every employee’s responsibility to comply with the company’s Code of Business Conduct. This includes but is not limited to adherence to applicable federal and state laws, rules, and regulations as well as company policies and training requirements.

Highmark Health and its affiliates prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities and prohibit discrimination against all individuals based on any category protected by applicable federal, state, or local law.

California Consumer Privacy Act Employees, Contractors, and Applicants Notice