DataStaff, Inc. is seeking a Senior Business Analyst for a long-term contract opportunity with one of our direct clients in Albany, NY.
*This position is hybrid
Job Description
The Senior Business Analyst will define, analyze, and validate business and system requirements for a health benefit exchange platform. You will lead requirements activities for complex enhancements, collaborate with business and technical stakeholders, and support accurate, scalable, and compliant solutions within a multi-tier, service-oriented architecture. You will also mentor analysts and serve as a subject matter expert on eligibility rules, enrollment processes, notices, and system behavior.
What you'll do
Lead the elicitation, documentation, and validation of business rules, functional requirements, and non-functional requirements for complex enhancements or multi-system initiatives.
Facilitate requirements workshops, stakeholder interviews, and design walkthroughs to drive clarity and consensus.
Independently develop detailed use cases, process flows, data mapping, acceptance criteria, and impact analyses.
Ensure requirement completeness, traceability, and alignment with program objectives, regulatory needs, and system constraints.
Serve as a key liaison between business stakeholders, technical design teams, development teams, QA, and operations.
Communicate complex system behaviors, technical impacts, and policy interpretations in a clear, structured manner.
Support solution design discussions by providing business insights, system context, and analysis of downstream impacts.
Lead cross-team requirement clarification sessions and resolve requirement ambiguities proactively.
Conduct end-to-end business impact assessments for policy changes, defect fixes, and system enhancements.
Partner with QA to validate test coverage, review test scenarios, and ensure alignment with business requirements.
Support user acceptance testing (UAT) by clarifying requirements, resolving issues, and confirming system behavior.
Analyze production issues to determine whether defects stem from requirement gaps, design errors, or process issues.
Develop deep expertise in eligibility rules, enrollment processes, notices, and regulatory constraints.
Conduct root cause analyses for complex system issues and lead business-side remediation planning.
Identify opportunities to streamline processes, improve requirement quality, and strengthen cross-team workflows.
Use approved AI tools to support requirement analysis, scenario modeling, impact detection, and documentation refinement, validating results to ensure accuracy and compliance.
Provide guidance and coaching to junior and mid-level analysts on requirements practices, analysis techniques, and domain knowledge.
Review and provide feedback on requirement documents created by other analysts.
Support onboarding of new team members by sharing system knowledge, tools, and methodologies.
What you'll bring
Bachelor’s degree in a relevant technical, analytical, policy, or business field, or an equivalent combination of education and experience.
6+ years of experience as a Business Analyst in application development or large-scale enterprise environments.
Proven experience developing comprehensive functional requirements, business rules, and detailed use cases.
Strong understanding of requirements engineering within Agile frameworks, including user stories, acceptance criteria, grooming, and traceability.
Expert analytical and problem-solving skills with the ability to interpret complex data and policy rules.
Ability to independently lead requirements activities and influence cross-functional teams.
Strong verbal and written communication skills, with the ability to explain technical concepts to diverse audiences.
Exceptional documentation skills with attention to precision, clarity, and traceability.
Ability to manage multiple large initiatives simultaneously with minimal supervision.
Skilled in facilitating discussions, navigating differing viewpoints, and driving consensus.
Ability to translate business needs into actionable requirements and testable outcomes.
Proficiency with requirements management tools and collaboration platforms.
Demonstrated ability to use AI tools responsibly to enhance analysis and documentation quality.
Nice to have
2+ years of healthcare, Medicaid, and/or health exchange industry experience.
In-depth experience with ACA eligibility, enrollment, or notices.
Experience in healthcare, Medicaid, or health exchange environments.
Exposure to state or federal program regulations.
Familiarity with multi-tier enterprise systems, service-oriented architecture, and integrated applications.
DataStaff offers W-2 employment opportunities with a competitive benefits package. Many of our positions include access to medical, dental, and vision insurance, as well as paid vacation, sick leave, and holidays. Recognizing that many of our assignments are long-term, DataStaff also offers a 401(k) retirement savings plan, with employees becoming eligible after six months of employment.
Governance, Risk & Compliance (GRC) Analyst
Location:Morrisville, North Carolina
Type:Contract
Job#12728
DataStaff Inc is seeking an experienced Governance, Risk & Compliance (GRC) Analyst to support and independently lead cybersecurity governance, risk, and compliance initiatives across a complex technology environment for our client in Morrisville, NC.
Job Description This position will play an important role in strengthening the organization's risk management practices, control environment, audit readiness, and overall security governance program. The ideal candidate combines hands-on GRC experience with enough technical understanding to evaluate controls across modern cloud, SaaS, API, distributed-system, and DevSecOps environments. This person must be comfortable working independently while partnering with stakeholders across Information Security, IT, Product, Legal, Privacy, Procurement, Finance, HR, Audit, and other business functions. Successful candidates should demonstrate strong risk-based judgment, consultative communication, stakeholder influence, ownership, and continuous improvement. The position requires someone capable of independently managing complex workstreams while creating repeatable processes, templates, mappings, and guidance that improve the maturity and consistency of the GRC program.
Key Responsibilities
Lead cybersecurity risk assessments, maturity assessments, framework gap analyses, and control-mapping exercises, developing well-supported findings and practical recommendations.
Coordinate internal and external audits, certification activities, customer security and assurance requests, evidence collection, and related compliance activities.
Manage remediation efforts from identification through resolution, including issue tracking, exceptions, evidence reviews, corrective actions, and cross-functional follow-up.
Develop and maintain security policies, standards, procedures, control mappings, governance templates, assessment methodologies, and other reusable GRC documentation.
Support the organization's third-party risk management program, including vendor due diligence, risk assessments, documentation reviews, remediation follow-up, and ongoing monitoring.
Partner with technical and business stakeholders to evaluate control requirements, risk treatment strategies, compensating controls, exceptions, and corrective actions.
Evaluate the design, applicability, and operating effectiveness of security controls across technology environments.
Develop dashboards, metrics, management reports, and status updates that provide visibility into risks, remediation efforts, compliance activities, and program performance.
Help improve GRC processes, methodologies, documentation, and overall audit readiness.
Provide guidance and mentoring to less-experienced team members when appropriate.
Required Experience & Qualifications
5–8 years of relevant professional experience in cybersecurity GRC, information security risk management, internal audit, compliance, third-party risk, privacy, control assurance, or a closely related discipline.
At least 2 years of hands-on experience performing risk or control assessments, framework mapping, control reviews, audit coordination, remediation management, or similar GRC activities.
Demonstrated ability to independently lead work across multiple programs, systems, products, security/control domains, frameworks, or stakeholder groups.
Strong understanding of cybersecurity governance, risk management, compliance practices, security policies, control frameworks, control taxonomies, issue management, evidence management, and exception processes.
Working knowledge of technical security controls and modern SaaS, cloud, API, distributed-system, and DevSecOps environments sufficient to assess control design and effectiveness.
Experience coordinating audits and reviewing evidence for completeness and sufficiency.
Experience creating policies, standards, procedures, control mappings, assessment documentation, dashboards, and management reporting.
Strong analytical and risk-based decision-making skills, including the ability to develop practical recommendations when requirements or circumstances are ambiguous.
Ability to communicate GRC and security concepts effectively to both technical and non-technical audiences.
Demonstrated ability to influence stakeholders and drive issues toward resolution without relying on direct authority.
Bachelor's degree in Cybersecurity, Information Systems, Business, Accounting, Risk Management, Public Policy, or a related discipline, or an equivalent combination of directly relevant education and professional experience.
Preferred Qualifications
Experience within B2B SaaS, healthcare, regulated industries, cloud-based organizations, or multi-product technology environments is preferred.
Candidates with experience developing formal GRC documentation—including policies, standards, control mappings, assessment procedures, governance templates, audit packages, and executive/management reporting—will be particularly relevant.
Professional certifications are also desirable, including CISA, CRISC, CISM, CISSP, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or relevant certifications in third-party risk, privacy, or auditing.
Experience mentoring other analysts or leading a significant audit, certification, product compliance, third-party risk, or remediation initiative is also preferred.
This opportunity is available on a corp to corp basis or as a W2 position with a competitive benefits package. DataStaff, Inc. offers medical, dental, and vision coverage options as well as paid vacation, sick, and holiday leave. As many of our opportunities are long-term, we also have a 401k program available for employees after 6 months.