Information Security Analyst

Harvard University • Boston, MA

1d • Remote

About The Position

Harvard Medical School’s Information Technology Department enables the school’s mission by delivering secure and scalable services. Its Security team is seeking an Information Security Analyst to help build and sustain vulnerability, cloud, and data loss prevention management solutions and provide operational support for HMS infrastructure. The work spans traditional on-premises systems and contemporary cloud solutions, in collaboration with departments across HMS IT and Harvard University IT.

The position is fully remote at a non-Harvard location. Employees must work scheduled hours in a Harvard-registered state and may occasionally be required to work on site at a Harvard location, at the department’s discretion. The schedule is 35 hours per week. Harvard is unable to provide visa sponsorship.

Requirements

• At least five years of experience after post-secondary education or equivalent relevant work experience.
• Working knowledge of vulnerability management fundamentals, including CVE and CVSS, risk prioritization, and remediation timelines.
• Ability to obtain results from technical staff who do not report to you, with strong written and verbal communication skills.
• Hands-on experience with enterprise vulnerability scanning, endpoint protection, or asset inventory tools.
• Experience with cloud security posture management and common cloud misconfigurations.
• Experience with vendor or third-party security risk assessments.
• Experience with data loss prevention alert triage and sensitive data remediation.
• Experience with endpoint management and agent deployment at scale.
• Experience with IT service management or GRC ticketing and reporting.
• Strong problem-solving skills, attention to detail, and the ability to act as a trusted advisor.

Nice To Haves

• Bachelor’s degree in information systems, cybersecurity, or a related field.
• Familiarity with HIPAA, NIST SP 800-53, the NIST Cybersecurity Framework, or comparable frameworks.
• Experience in higher education, an academic medical center, or a research environment, especially with decentralized IT groups.
• One or more of the listed certifications: SecAI+, Security+, PenTest+, CCSK, or Cloud+.

Responsibilities

• Operate recurring vulnerability and compliance reporting, quality-check results, and distribute reports to HMS groups on schedule.
• Advise system administrators on findings and remediation, and track issues through verified closure.
• Run day-to-day execution of endpoint security compliance, ensuring required security agents are deployed and healthy.
• Monitor cloud security posture, triage misconfigurations, and coordinate remediation with cloud owners.
• Support vendor risk management, including security reviews and follow-up on identified issues.
• Triage data loss prevention alerts and coordinate remediation of sensitive data on shared storage.
• Support security assessments, penetration testing, and the security awareness program.
• Build dashboards and reports, and use basic scripting to automate recurring tasks.

Benefits

• Generous paid time off, including parental leave.
• Medical, dental, and vision health insurance coverage starting on day one.
• Retirement plans with university contributions.
• Wellbeing and mental health resources.
• Support for families and caregivers.
• Professional development opportunities, including tuition assistance and reimbursement.
• Commuter benefits, discounts, and campus perks.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed