IT Security Analyst

University of California, San Francisco • San Francisco, CA

1d

About The Position

The Cybersecurity Awareness Analyst leads the design and execution of the organization’s security awareness and training programs in support of its healthcare and research mission. This role develops and delivers programs that ensure faculty, staff, students, and affiliated personnel “know, understand, and follow [security] requirements” in order to reduce institutional risk. The Analyst works closely with the Cybersecurity Risk Management Manager and CISO to support broader security initiatives, policy development, and compliance (e.g. HIPAA, FERPA, institutional data protection). The position balances communications, training, and technical expertise to foster a culture of security across research, academic, healthcare, and IT communities. This experienced IT security professional applies specialized expertise in security awareness, governance, and training. The Analyst designs and recommends methods and strategies to achieve security awareness goals, leveraging advanced knowledge of cybersecurity principles, regulatory requirements, and learning best practices. The individual works independently to develop creative, long-term awareness solutions and provides technical and strategic support on security policy implementation throughout the institution. The Cybersecurity Research Security team support activities as assigned, including coordination of research security communications, meeting support, tracking action items – MCA, POAM, documentation updates, training records, compliance evidence collection, stakeholder follow-up, and other audit/assessment related program support duties consistent with the IT Security Analyst classification and departmental needs.

Requirements

• Bachelor’s degree in Computer Science, Information Security, Education, Communications, or a related field (or equivalent experience).
• Minimum related experience, 5+ years
• Communication: Able to translate complex security concepts into clear, concise messages for diverse audiences (students, faculty, clinicians, IT staff)
• Security Expertise: Broad knowledge of information security principles, risk management and threat landscape. Familiarity with NIST or similar frameworks. Understanding of healthcare and research privacy requirements (HIPAA, FERPA) and how to incorporate them into training
• Project Management: Strong organizational and planning skills. Experience managing projects from conception through implementation, including scheduling, resource coordination, and reporting
• Collaboration: Proven ability to work cross-functionally with IT, legal/compliance, clinical, and academic stakeholders. Skilled at coordinating people and tasks across departments to achieve security goals.
• Relevant professional certifications preferred (e.g. CISSP, CISM, Security+).
• Certification or coursework in security awareness, instructional design, or project management is desirable.
• Analytical Skills: Problem-solving mindset and attention to detail. Able to assess program outcomes, identify areas for improvement, and adapt strategies accordingly.
• Basic understanding of information risk concepts is required

Nice To Haves

• Proficiency with training design and delivery (e.g. adult learning, e-learning platforms, phishing simulation tools).
• Ability to evaluate training effectiveness and metrics (completion rates, assessment results).

Responsibilities

• Develop, manage, and operate security awareness programs. Plan, organize, and deliver comprehensive cybersecurity training and awareness activities (e.g. phishing simulations, workshops, e-learning) targeting students, faculty, healthcare providers, and staff. Create engaging content (e.g. videos, newsletters, campaigns) and ensure training effectively changes user behavior to reduce human risk
• Governance and policy support. Assist in developing and updating cybersecurity policies, standards and guidelines. Ensure awareness initiatives align with regulatory requirements (HIPAA, FERPA, etc.) and enterprise security policies. Help coordinate policy communication so that all community members understand and follow requirements
• Regulatory and technical training. Provide specialized training on relevant regulations (e.g. HIPAA, data privacy laws, research compliance) and IT security concepts (e.g. secure data handling, mobile device security) to varied audiences. Work with curriculum and compliance teams to incorporate cybersecurity topics into mandatory training for healthcare workers and research staff.
• Communications and outreach. Create clear, accessible communications (email bulletins, web content, posters) to reinforce security best practices. Represent the department at campus events (e.g. Cybersecurity Awareness Month, training fairs), and engage campus and affiliate communities in security culture. Tailor messages to diverse groups (students, researchers, clinicians) based on their needs
• Project management support. Assist the Manager and CISO on departmental projects. Provide project planning, scheduling, and progress reporting for initiatives like compliance audits, risk assessments, and security campaigns. Coordinate with IT and operational teams to ensure timely project execution and follow-up.
• Collaboration with UC and external partners. Participate in UC systemwide security working groups, sharing best practices and policies. Maintain relationships with security training vendors and professional networks. Leverage these resources to enhance the awareness program and stay current on effective training techniques.
• Other related duties as assigned. Performs additional tasks consistent with departmental needs and bargaining-unit guidelines.
• Cybersecurity Research Security support. Provides miscellaneous Cybersecurity Research Security team support activities as assigned, including coordination of research security communications, meeting support, tracking action items – MCA, POAM, documentation updates, training records, compliance evidence collection, stakeholder follow-up, and other audit/assessment related program support duties consistent with the IT Security Analyst classification and departmental needs.

Benefits

• Certain terms and conditions of employment for this position, including the rate of pay, benefits, etc., are currently subject to negotiation with the appropriate union.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level