Senior Information Security Analyst - Cloud and AI Security

UHS•Tredyffrin Township, PA

70d

About The Position

Universal Health Services (UHS), a Fortune 500® corporation and a leading provider of hospital and healthcare services, is seeking a dynamic Senior Information Security Analyst specializing in Cloud and AI Security for its Corporate Information Services Department. This role serves as a technical lead within the Cybersecurity team, focusing on securing applications, AI-enabled solutions, and autonomous AI agents across UHS and its affiliates. The analyst will be responsible for identifying, assessing, documenting, and mitigating security vulnerabilities in both traditional and AI-powered applications. Key duties include guiding secure development practices, collaborating with architecture, development, infrastructure, and business teams to integrate security throughout the Software Development Lifecycle (SDLC) and emerging AI workflows, and providing technical guidance and independent validation. The position also involves training and supporting technical staff at UHS affiliated locations on selected technologies and adhering to UHS standards of service excellence, professionalism, and integrity.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field required.
Minimum 5-8 years of experience in information security, with at least 3 years of dedicated Application Security experience (secure code review or penetration testing).
Hands-on experience in Application Security (SAST, SCA, DAST, WAF, ASPM) with a background in secure code development (DevSecOps, SSDLC) required.
Proficient with design, configuration, management and support of some or all of the following or similar information security technologies or processes: Anti-malware protections and analysis, Web filtering and security, Vulnerability scanning and management, Encryption technologies for data at rest and data in transit, Mobile device and removable media protection or management systems, Authentication – including various forms of SSO and MFA, Cloud application security, Security Information and Event Management (SIEM) systems, Interpreting Common Vulnerabilities and Exposures (CVE) data, OWASP Top 10, NIST AI Risk Management Framework (AI RMF), Device control, Data Loss Prevention (DLP), Forensic analysis.
Familiarity with risk assessment and risk management concepts or processes.
Working knowledge of various regulatory security requirements – particularly Sarbanes-Oxley (SOX), HIPAA, and HITECH.
Working knowledge of common cyber security frameworks such as HITRUST, NIST, or others.
Able to plan, organize, manage and execute projects, working with other technical staff, to implement cyber and information security technologies or processes.
Able to prioritize multiple tasks and be detail oriented.
One or more information security certifications are required – AppSec preferred. (OffSec, TCM, SANS, HTB, ISC²)
Excellent communication, interpersonal and project management skills

Nice To Haves

Experience with security tools such as GitHub Advanced Security, Veracode, Snyk, or similar is preferred.
Hands-on experience securing and assessing AI-enabled applications, autonomous AI agents, and AI/ML pipelines is a plus.
Working knowledge of scripting languages such as Python, PowerShell, and VB is a plus.

Responsibilities

Maintains selected information security technologies within guidelines of policies and in keeping with good project management principles.
Monitors the resolution of maintenance or enhancement issues assigned by the UHS Customer Support Center.
Lead and perform in-depth security assessments of web, mobile, API, cloud-based, and AI-enabled applications and autonomous AI agents through code reviews, using tools such as SAST, DAST, IAST, SCA, manual techniques, and penetration testing, including adversarial AI testing (prompt injection, jailbreak and guardrail bypass, model poisoning, RAG and MCP review, and AI agent abuse).
Periodically reviews deployed security technologies to ensure that the solutions continue to provide the intended protections efficiently and effectively.
Work closely with DevOps and engineering teams to integrate security into CI/CD pipelines (DevSecOps) and AI/ML pipelines, and develop secure coding guidance, AI security standards, and runtime control baselines.
Identifies gaps in protection and recommends solutions to remediate or mitigate the risks associated with the protection gaps.
Document findings and assist in creating reports and metrics for technical and non-technical audiences.
Works with staff at all levels in the organization, vendors and contractors to ensure protections are effective, efficient and non-disruptive to the appropriate duties, rights and mission of the individuals and the organization(s) affected.
Acts as the subject matter expert (SME) for at least one technology or process, and guides the efforts of 1-3 less experienced staff who assist with the assigned technology or process.
Monitors the resolution of maintenance or enhancement issues assigned by the UHS Customer Support Center.