Senior Information Security Analyst - IT Solutions

Texas Woman’s University•Denton, TX

About The Position

The Senior Information Security Analyst analyzes and assesses the university’s information systems, policies, processes, and procedures to identify security gaps and weaknesses and develop remediations. The role collaborates with university stakeholders to implement processes and procedures, promote security best practices, coordinate compliance audits and policy changes, conduct assessments, and lead security awareness and training efforts. As a member of IT Solutions (ITS), the analyst contributes to a collaborative, human-centered, innovative, accountable, transparent, and inclusive culture and supports the division’s mission to empower an agile, digital university and elevate technology as a strategic institutional asset. The position monitors and analyzes system activity using cyber defense tools; reviews enterprise architecture, systems, and data flows; develops and maintains security policies; triages incidents; audits compliance; manages security-related projects and remediation; and provides cybersecurity support. It also performs risk assessments for software, systems, and cloud-hosted services; participates in regulatory and university assessments; supports training and awareness campaigns; prepares reports and briefings; and keeps ITS leadership informed of performance and system status. The role reports to the Associate Director, Information Security and has no supervisory responsibilities.

Requirements

Bachelor’s degree required; additional job-related experience may substitute year-for-year for the required education.
Five years of relevant information and/or cybersecurity experience; additional job-related education may substitute year-for-year for the required experience.
Ability to maintain infrastructure security and integrity and understand information security theories, principles, practices, methods, and techniques.
Ability to apply cybersecurity and privacy principles to organizational requirements, including confidentiality, integrity, availability, authentication, and non-repudiation.
Ability to develop and maintain project plans and manage small- to medium-sized projects and system enhancements affecting information security.
Ability to collect and use data, such as indicators of compromise, from a variety of cyber defense resources; recognize and categorize vulnerabilities and associated attacks.
Skill in writing and reviewing information security policies and procedures, and knowledge of IT auditing processes and remediations.
Strong written, oral, analytical, problem-solving, and interpersonal skills, including the ability to communicate in user-friendly, business-friendly, and technical language and build rapport.
Ability to build effective relationships and work collegially and collaboratively with constituents at all levels in a diverse and distributed environment.
Knowledge of Texas Administrative Code (TAC 202) requirements.
Ability to use a personal computer, office equipment, university software, and email.
Regular and reliable attendance at the university during scheduled workdays and hours.
Ability to travel and potentially work evenings, weekends, and holidays.
All offers are contingent on providing proof of identity and U.S. work eligibility; security-sensitive positions require background checks and verification of academic credentials.
Applicants subject to Selective Service registration requirements must comply with applicable federal and Texas law.

Nice To Haves

CompTIA Security+ certification and/or other security or project management certifications.
Knowledge of MITRE ATT&CK and SHIELD frameworks.
Knowledge of information security frameworks such as ISO 27001, NIST 800-53, or NIST 800-171.
Certifications such as CompTIA Security+, SSCP, CISSP, or CISA.
Professional project management or IT certifications such as PMP, ITIL, Six Sigma, or agile certifications.
Experience creating enterprise security documents.
Experience delivering employee security awareness training.
Experience in a higher education setting.
Experience implementing security controls in accordance with Texas Administrative Code (TAC 202).

Responsibilities

Use cyber defense tools to continually monitor and analyze system activity, identify malicious activity, and assess weaknesses exploited, exploitation methods, and effects on systems and information.
Examine enterprise architecture and systems to understand criticality and data flows and identify security control improvements that reduce exposure and attack surface.
Create, review, and maintain information security policy documentation consistent with university policies, Texas Administrative Code 202, and other applicable regulations and requirements.
Collaborate with ITS and functional-area subject matter experts to validate events and alerts, triage security incidents, and identify needs for new or updated IT policies and awareness training.
Coordinate with the university’s Compliance Officer on information security policy and policy compliance matters.
Audit the organization for compliance with defined administrative and operational requirements and escalate exceptions.
Recommend security improvements by assessing current conditions, evaluating trends, and anticipating requirements.
Project-manage requirements gathering, design, development, implementation, and delivery of security technologies and process improvements.
Lead remediation work identified through internal or external audits, penetration testing, or other assessments.
Provide timely IT security support, respond to incident and problem tickets, and troubleshoot cybersecurity issues.
Perform and maintain risk assessments for information security and data protection requirements related to new software, systems, and cloud-hosted services.
Participate in assessments and audits for regulatory or university requirements, including TAC 202, PCI, and HIPAA.
Participate in developing and delivering information security training and awareness campaigns as needed.
Provide substantive content for reports and briefings on policy, strategy, and audit and assessment activities.
Prepare performance reports and communicate system status to ITS leadership.
Maintain awareness of current practices, future trends, best practices, and applicable security regulations and requirements.
Represent IT Solutions and participate in campus working groups, project teams, and university committees.
Perform other duties as requested.