Cybersecurity Analyst II

The University of Texas at Austin • Austin, UT

2d • Onsite

About The Position

The Cybersecurity Analyst II is an intermediate-level professional who develops, maintains, and improves enterprise cybersecurity programs that protect organizational systems, networks, and data. Reporting to the Manager of Enterprise IT Security and Operations, the role designs and documents program components and manages work in assigned domains such as risk management, incident response, vulnerability management, and threat intelligence, with guidance and within established frameworks. The position updates policies, procedures, playbooks, runbooks, and automation, and supports alignment with regulatory and security frameworks including HIPAA, FERPA, PCI DSS, GDPR, ISO 27001, and NIST. It works with IT and business teams to integrate security requirements into operational processes and the software development lifecycle, provides guidance to junior analysts, and supports security awareness and a risk-aware environment.

The position also conducts security investigations, supports governance, risk, and compliance activities, maintains program metrics and reports, coordinates with campus IT and the Information Security Office on security controls, and contributes to audit, disaster recovery, and business continuity activities. The role is based at the UT Main Campus and is scheduled for 40 hours per week. The position is expected to continue.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, with at least 3 years of cybersecurity experience; relevant education and experience may be substituted as appropriate.
• Experience in cybersecurity areas such as incident response, vulnerability management, or threat monitoring, including demonstrated experience developing cybersecurity programs and associated tooling.
• Experience with risk and compliance frameworks such as NIST RMF, NIST CSF, ISO, HITRUST, or NIST 800-53.
• Strong knowledge of security protocols, network monitoring, and vulnerability assessment tools.
• Demonstrated experience in security incident detection, investigation, and response.
• Demonstrated knowledge of network protocols, operating systems, SIEM tools, and ITIL processes.
• Ability to analyze complex issues, correlate telemetry from multiple sources, identify root causes, and select evidence-based mitigations.
• Ability to make timely risk-based decisions, prioritize actions, and communicate next steps and contingencies.
• Technical capability across SIEM/SOAR, endpoint security, vulnerability scanners, and core cybersecurity domains.
• Ability to operate and improve processes, maintain SOPs and runbooks, and automate repetitive tasks.
• Ability to act effectively amid ambiguity and changing information.
• Ability to collaborate across teams, align remediation plans with IT and application owners, facilitate exercises, and diplomatically escalate issues.

Nice To Haves

• At least 5 years of experience in network scanning, cloud security, Risk Management Frameworks (RMF), threat intelligence programs, vulnerability management programs, or SOAR platforms.
• Four years of healthcare experience, including knowledge of healthcare missions, HIPAA regulations, and medical device security considerations.
• Experience with ServiceNow Security Operations and Security Incident Response modules or similar ITSM platforms.
• Preferred certifications: GIAC Certified Incident Handler (GCIH), Certified Incident Handler (ECIH), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), or CompTIA Security+.

Responsibilities

• Develop and document policies, standard operating procedures, playbooks, and runbooks for assigned cybersecurity domains, aligning them with organizational standards and regulatory frameworks.
• Implement automation and process improvements to strengthen controls and improve the efficiency and effectiveness of cybersecurity programs.
• Maintain program dashboards and performance metrics, incorporate lessons learned, and recommend program refinements.
• Collaborate with IT and business stakeholders to integrate security requirements into operations and the software development lifecycle.
• Coordinate with department IT teams, campus IT, and the Information Security Office to review, implement, and monitor security controls, including firewalls, DLP, and MFA.
• Manage security event investigations end-to-end and coordinate resolution within the role’s scope.
• Refine playbooks and runbooks and implement automation for repetitive tasks such as enrichment, triage, alerts, and notifications.
• Apply security policies, standards, and procedures; perform control testing and gather audit evidence.
• Monitor adherence to HIPAA, FERPA, PCI DSS, GDPR, ISO 27001, and NIST frameworks.
• Update risk registers, propose mitigations, and track remediation through completion.
• Conduct third-party and vendor security assessments against organizational standards and document follow-up actions.
• Help facilitate security awareness initiatives and tabletop exercises, providing coaching during activities.
• Prepare reports with actionable recommendations for stakeholders and leadership.
• Partner with IT and project teams to embed security requirements in designs and changes, and review changes for security impact.
• Maintain cybersecurity documentation such as architecture diagrams, SOPs, and inventories.
• Represent the organization during audits and external assessments as assigned.
• Participate in professional development and advanced training.
• Support updates to disaster recovery and business continuity plans.
• Adhere to internal controls and reporting structure and perform related duties as required.

Benefits

• Teacher Retirement System of Texas (TRS) retirement plan eligibility, subject to the position meeting the stated hours-per-week and duration conditions.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level