IT Security Risk and Compliance Analyst
About The Position
Under the guidance of the Associate Director of IT Risk and Compliance, the IT Security Risk and Compliance Analyst will carry out IT security assessment activities including IT risk assessments and security reviews for university departments, as well as evaluations of third-party technology solutions, to ensure alignment with university policies, standards, and external compliance regulations wherever applicable. Assessment activities may include a wide variety of tasks depending on the scope of the review and the IT capabilities within university departments (e.g., developing asset inventory, assessing endpoint and application security controls and configurations, examining procedures, etc.). The analyst will be expected to contribute to the creation and maintenance of documentation/procedures in support of the IT Risk and Compliance program and to identify opportunities to leverage automation to enhance data consistency and process efficiency within the program and across other university IT services. The analyst may provide training and outreach to the university community as needed and may also be called on to coordinate updates for the IT Continuity of Operations plan and to assist units within the Division of Information Technology as they conduct disaster recovery planning or on other security-related initiatives as requested.
Requirements
- Master's degree, or a combination of education, training, and progressive experience that equates to a Master's degree.
- Demonstrated experience performing IT security reviews, risk assessments, or audits
- Strong understanding of key information security concepts and fundamentals
- Experience in creating awareness of security practices across multiple technical teams
- Knowledge of security frameworks and standards, including NIST, PCI-DSS, ISO 27001, CIS Critical Security Controls, NIST Cybersecurity Framework (NIST CSF), etc.
- Ability to effectively communicate across a broad range of campus audiences
- Exceptional organizational and time-management skills
Nice To Haves
- Professional certification such as CISA, CISM, CRISC, or CISSP
- Experience performing security assessments of SaaS services
- Knowledgeable of relevant compliance regulations (e.g., FERPA, GLBA)
- Experience with GRC and Information security tools/technologies to collect and maintain security and risk information
- Experience with automation using common scripting tools (e.g., Python, PowerShell, Bash, etc.)
- Experience with data analysis and manipulation
- Experience managing IT security risk or compliance in a higher education setting
Responsibilities
- Carry out IT security assessment activities including IT risk assessments and security reviews for university departments.
- Evaluate third-party technology solutions to ensure alignment with university policies, standards, and external compliance regulations.
- Develop asset inventory, assess endpoint and application security controls and configurations, and examine procedures.
- Contribute to the creation and maintenance of documentation/procedures in support of the IT Risk and Compliance program.
- Identify opportunities to leverage automation to enhance data consistency and process efficiency.
- Provide training and outreach to the university community as needed.
- Coordinate updates for the IT Continuity of Operations plan.
- Assist units within the Division of Information Technology with disaster recovery planning or other security-related initiatives.
Benefits
- Professional development opportunities
- University shared governance
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
