IT Security Architecture Analyst II (Cybersecurity)

Emory University•Atlanta, GA

9d•Remote

About The Position

The IT Security Architecture Analyst II works within Emory University's Enterprise Information Security team to identify, evaluate, and implement security controls for IT services supporting Emory University and Emory Healthcare. The role assesses solutions and their applications, processes, vendors, and technologies across individual, departmental, divisional, and enterprise settings, including on-premises, cloud-based, vendor-hosted, and custom-developed environments. The analyst performs and contributes to security risk assessments, identifies and analyzes risks, recommends remediation or mitigation, and transfers associated risks to the enterprise risk register process. The role also researches vulnerabilities and emerging technologies, supports customer consultation, communicates information security safeguards, helps interpret policies and requirements, and contributes to improvements in risk-management processes and tools. Vendor assessments use toolkits and frameworks such as HIPAA, HITRUST, SOC, and NIST, with findings documented in written reports. The position works semi-independently with periodic management check-ins and close collaboration with the analyst's team. It works with cloud engineering, information security, IT, privacy, compliance, legal, procurement, research, business units, and IT leadership. Tasks can be performed remotely with occasional visits to an Emory University location; Eastern Time business hours may apply. Emory does not approve primary work locations in New Jersey, Alaska, Hawaii, U.S. territories, or outside the United States.

Requirements

Bachelor's degree and three years of related IT experience, including demonstrated experience in relevant information security domains, and project-management skills; or an equivalent combination of education, training, and experience.
Excellent project-management and team-participation skills.
Good written and verbal communication skills.
Solid background in IT solutions and security concepts, including their development, deployment, and administration.
Practical knowledge of the job area, typically obtained through advanced education and work experience.
Ability to work semi-independently with periodic management check-ins and in close collaboration with the analyst's team.
Communication with IT leadership is required.

Nice To Haves

Experience or exposure to AI technologies, including chatbots, LLMs, machine learning, deep learning, generative AI, NLP, computer vision, and agentic systems.
Experience or exposure to research cybersecurity, including human-subject research studies.
Experience or exposure to cloud security fundamentals and AWS, Azure, or GCP.
Experience or exposure to Microsoft-connected security concepts such as Entra, Graph API, and Fabric.
Experience or exposure to programming fundamentals, code reviews, and APIs.
Experience or exposure to academic, research, or healthcare technologies.
Exposure to architecture components such as systems, virtual machines, Docker, networking, databases and NoSQL, mobile apps, authentication, and enterprise architecture offerings.
Experience in healthcare, university, research, cloud, or medium-to-large enterprise environments.
Knowledge of information security technologies, methodologies, and best practices in security architecture, vulnerability identification and safeguards, data protection, business continuity, and related security domains.
Security certifications such as SANS/GIAC, CISSP, CISA, CISM, AWS, GCP, or Azure.
Experience with cloud platform solutions.

Responsibilities

Contribute to and perform security risk assessments for IT solutions, including identifying, analyzing, and evaluating risks; recommending remediation or mitigation; and handing risks off to the enterprise risk register management process.
Apply policies, published guidelines, best practices, and industry recommendations when advising internal and external customers.
Research and analyze vulnerabilities and consult with internal and external customers about them.
Help ensure information security safeguards and controls are communicated and followed.
Assess solution providers and the applications, processes, vendors, and technologies used across departments, divisions, and the enterprise, including on-premises, cloud-based, vendor-hosted, and custom in-house solutions.
Identify improvements to risk-management processes and tools.
Collaborate with cloud engineering, enterprise information security, IT, privacy, compliance, legal, procurement, research, and business units to protect institutional assets.
Apply IT, system architecture, security, and vendor-risk-assessment knowledge, and research emerging technologies and vulnerabilities.
Contribute to development of risk-analysis tools and provide functional guidance to customer teams conducting security risk assessments of projects.
Assist with interpreting information security policies and determining their applicability.
Assess client vendors using risk-assessment toolkits and frameworks such as HIPAA, HITRUST, SOC, and NIST; collect data, identify compliance and non-compliance areas, and prepare written assessment reports.
Assess risks across solution architecture components, including services, controls, networks, operating systems, databases, storage, applications, security configurations, virus prevention and remediation, encryption, network segmentation, remote access, and authentication.
Undertake other information security tasks and projects as needed, including supporting university or healthcare units across the enterprise.
Perform other related duties as required.