IT Security Professional - 2

UNC-Chapel Hill•Chapel Hill, NC

About The Position

The IT Security Professional is a senior-level technical position within Finance and Operations IT (FOIT) at the University of North Carolina at Chapel Hill. Serving as a subject matter expert and primary escalation resource, the role plans, implements, and manages secure, high-performance information technology infrastructure and systems. Its scope spans information security, server and database administration, network architecture, web application development, and IT project management. The position protects University systems and data by designing and maintaining network security architecture; deploying and managing security monitoring tools; directing forensic analysis and incident response; and establishing security policies and procedures that comply with applicable University, state, and federal requirements. It provides escalation support to peers, ITS management, and departmental units for complex technical incidents and security events, and consults with departmental computing organizations on secure operations, change management, segregation of duties, and coding best practices. The role manages IT projects from initiation through completion, helping ensure systems that handle sensitive or restricted data are delivered on schedule, within scope, and with appropriate safeguards. It collaborates with administrators and stakeholders to assess technology needs, recommend solutions, and improve IT systems and workflows. The position also contributes to disaster recovery and business continuity planning, as well as ongoing monitoring, reporting, and improvement of the unit’s security posture. Strong analytical, communication, and problem-solving skills and the ability to work across organizational units in a complex university environment are required. Some after-hours availability may be required to respond to security incidents or implement planned system changes with minimal service disruption.

Requirements

Progressively responsible experience in information technology, including significant experience in information security operations and server/systems administration.
Experience installing, configuring, and maintaining Microsoft Windows Server environments across multiple versions and roles, such as Active Directory, DNS, DHCP, Group Policy, and IIS.
Experience deploying and managing Microsoft SQL Server in high-availability configurations, including failover clustering, Always On Availability Groups, and backup and recovery strategies.
Fundamental working knowledge of Linux operating systems, including basic administration, patching, and command-line operation.
Experience supporting and maintaining enterprise applications with interdependent components such as relational databases, file servers, and web front-ends, and ability to diagnose issues across the application stack.
Understanding of redundant systems design and high-availability principles, including load balancing technologies such as F5 BIG-IP, web proxy configuration, and related network infrastructure.
Ability to perform network tracing and packet analysis to diagnose connectivity, performance, and security issues.
Experience with server virtualization platforms such as VMware or Hyper-V and understanding of physical-to-virtual and virtual infrastructure management.
Knowledge of information security principles, frameworks, and best practices, such as the NIST Cybersecurity Framework, CIS Controls, and ISO 27001.
Experience with network security architecture, including firewalls, intrusion detection and prevention systems, and access control technologies.
Demonstrated experience in security incident response, forensic analysis, and malware analysis.
Experience developing, implementing, and maintaining information security policies, standards, and procedures.
Proficiency with security monitoring tools, log management, and analysis.
Knowledge of identity and access management, account provisioning, and auditing practices.
Experience managing IT projects, including defining scope, timelines, and deliverables and proactively managing risks and constraints.
Strong written and verbal communication skills, including the ability to explain complex technical concepts to non-technical audiences.
Ability to manage multiple priorities and collaborate across organizational units in a complex environment.
Working knowledge of applicable federal, state, and University regulations governing information security and data privacy, including FERPA, HIPAA, PCI-DSS, and applicable North Carolina state IT security requirements.
Strong analytical and problem-solving skills and ability to work effectively across organizational units.
Some after-hours availability may be required for security incidents or planned system changes.

Nice To Haves

One or more professional certifications: CISSP, CISM, CEH, SSCP, CompTIA Security+, or an equivalent industry-recognized credential.
Prior information security or IT operations experience in higher education, particularly in a Finance and Operations or administrative computing environment.
Experience with web application development, content management systems, secure coding best practices, and OWASP guidelines.
Familiarity with IT Service Management frameworks such as ITIL and ITSM tools; experience participating in or presenting to a Change Advisory Board.
Experience developing and maintaining disaster recovery plans and business continuity strategies for IT environments.
Experience developing and delivering security awareness training to diverse end-user audiences.
Familiarity with web accessibility standards such as WCAG 2.1 and their application to university web systems and applications.
Familiarity with cloud platforms such as Azure, AWS, or Google Cloud and security controls in hybrid on-premises/cloud environments.
Experience supporting point-of-sale systems, financial transaction processing systems, or university card systems in a PCI-compliant environment.
Master’s degree in Cybersecurity, Computer Science, Information Technology, or a closely related field.

Responsibilities

Plan, implement, and manage secure, high-performance information technology infrastructure and systems.
Design and maintain network security architecture and deploy and manage security monitoring tools.
Direct forensic analysis and security incident response.
Establish and maintain information security policies and procedures in compliance with applicable University, state, and federal requirements.
Serve as a primary escalation resource for complex technical incidents and security events, supporting peers, ITS management, and departmental units.
Provide expert consultation on secure operations, change management, segregation of duties, and coding best practices.
Manage IT projects from initiation through completion, including systems handling sensitive or restricted data, ensuring delivery on schedule, within scope, and with appropriate safeguards.
Collaborate with administrators and stakeholders to assess technology needs, recommend solutions, and improve IT systems and workflows.
Participate in security policy and planning decisions.
Contribute to disaster recovery and business continuity planning.
Monitor, report on, and improve the unit’s overall security posture.