IT Risk & Information Security Analyst

Princeton University•Princeton, NJ

3d•$105,000 - $120,000•Onsite

About The Position

University Services at Princeton University is seeking an IT Risk & Information Security Analyst to help strengthen the security, privacy, resilience, and continuity of the systems and data that support a broad portfolio of campus services. This role leads and coordinates IT risk management, information security, data privacy, mission continuity, disaster recovery, incident response, and security awareness efforts across University Services. Reporting to the Senior Director of Information Technology for University Services, with a dotted line to the University Chief Information Security Officer, the analyst will work closely with University Services Information Technology (USIT); the Office of Information Technology (OIT), including the Information Security Office (ISO); departmental leaders; and operational partners to reduce risk and protect critical services. The analyst will serve the IT risk and information security needs of the University Services Office of the Vice President, University Services Administration, and the seven operating departments within University Services. This is a highly collaborative role for someone who can bridge policy, risk, technical controls, operational realities, and user education. The successful candidate will bring sound judgment, practical security and privacy knowledge, strong communication skills, and the ability to turn risk findings into clear, actionable improvements. A cover letter is required for full consideration. A full job description will be furnished prior to interview.

Requirements

Bachelor's degree in Information Technology, Cybersecurity, or a related field.
5+ years of relevant professional, hands-on experience in an IT risk management and/or information security role.
Experience with security incident response and management.
Familiarity with regulatory requirements and compliance standards.
Knowledge of data classification and management practices.
Knowledge of data privacy principles, privacy-aware data handling practices, and requirements related to sensitive and regulated data.
Proficiency in security testing tools and methodologies (e.g. vulnerability scanning, penetration testing, static and/or dynamic code analysis, etc.).
Experience using tools, automation technologies, dashboards, reporting platforms, or workflow systems to improve security operations, risk tracking, audit readiness, and remediation tracking, coordination, and follow-through.
Strong knowledge of security and privacy frameworks and best practices.
Ability to work collaboratively with cross-functional teams.
Strong communication and interpersonal skills.
Ability to foster and maintain positive and professional working relationships; ability to effectively handle interpersonal interactions at all levels and respond appropriately to conflicts and problems.
Ability to work with complex confidential information and/or issues using discretion and judgement.
Excellent written/oral communication skills in order to present findings to all levels of management.
Possess organizational skills to handle several projects simultaneously, accommodate shifting priorities, and meet deadlines.
Ability and drive to stay current with and report on the rapidly evolving risk and information security landscape.

Nice To Haves

Relevant and active certifications such as CISSP, CISM, CISA, or Security+.
Professional experience in a higher education environment.
Experience with the Family Educational Rights and Privacy Act (FERPA)
Experience with the Payment Card Industry Data Security Standards (PCI DSS)
Experience with privacy, data governance, data classification, or responsible data use initiatives in a complex organization.
Experience developing scripts, integrations, reports, or automated workflows that reduce manual effort and improve risk, security, compliance, or privacy processes.
Experience training, developing, and improving others’ understanding of risk and information security.

Responsibilities

Lead system and data security initiatives, including security architecture reviews, access audits, vulnerability management, remediation tracking and coordination, evidence collection, monitoring, reporting, and continuous risk reduction efforts to protect University Services systems and data and support compliance with university security standards and policies.
Support compliance with applicable regulations, standards, and University policies, including FERPA, GDPR, CCPA, PCI, and privacy-aware handling of sensitive and regulated data.
Conduct IT risk assessments, privacy reviews, and business impact analyses to identify threats, evaluate operational impacts, prioritize mitigation, and strengthen resilience.
Partner with USIT, ISO, OIT, and departmental teams on data classification, responsible data handling, retention, access management, endpoint protection, and secure system operations.
Perform or coordinate system and application security testing, vulnerability scanning, remediation follow-up, and related reporting using appropriate tools, dashboards, and automation.
Develop, maintain, and test mission continuity and disaster recovery plans for critical University Services functions, systems, applications, and data.
Serve as the primary University Services point of contact for security incidents, coordinating response, escalation, remediation, communication, post-incident review, and improvement activities.
Design and deliver security and data privacy awareness training for staff, translating policies, threats, and best practices into practical guidance for diverse audiences.
Prepare concise reports, metrics, briefings, and recommendations that help leaders understand risk, track progress, and make informed decisions.
Works on special projects as assigned.