Senior Information Security Analyst

UMass Amherst•Amherst, NY

2d•Hybrid

About The Position

The Senior Information Security Analyst delivers advanced technical and strategic leadership for the University’s hybrid information security program. The role oversees enterprise security operations—including vulnerability management, threat detection, incident response, and digital forensics—across on premises and cloud environments. The analyst leads secure architecture design for major technology projects, conducts complex security audits and risk assessments, and implements technical safeguards to protect institutional systems. They research emerging security technologies, advise leadership on solution strategy, and collaborate with stakeholders to manage risk, ensure compliance, and support the ongoing maturity of security policies, training, and metrics.

Requirements

Bachelor’s Degree with 7 years’ relevant experience -or- associate’s degree with 9 years’ relevant experience -or- high school diploma with 11 years' relevant experience.
Expert understanding of multiple IT domains and their interdependence.
Expert understanding of and experience with information security frameworks, privacy laws, and regulatory requirements (e.g., NIST, FERPA, HIPAA, PCI-DSS, ISO 27001).
Demonstrated technical understanding of system and network security, incident response, and compliance requirements.
Expertise in forensic analysis, and security architecture.
Experience with security tools such as SIEM, EDR/XDR, forensics tools, firewalls, IDS/IPS, vulnerability management platforms, etc.
Deep understanding of security governance, risk management frameworks, and regulatory compliance.
Demonstrated ability to lead security initiatives and projects at an enterprise level.
Strong analytical and critical thinking skills to assess security risks and develop mitigation strategies.
Experience designing, assessing and implementing security controls in one or more cloud environments, such as Microsoft Azure, Amazon AWS, Google GCP, etc.
Demonstrated technical understanding of system, network and cloud security, incident management, intrusion detection, vulnerability and patch management, and other related concepts and technologies.
Experience with computer incident response, including data collection, investigations, containment, and remediation.
Excellent written and verbal communication skills with ability to work with a diverse constituency in a service-based organization with both technical and non-technical team members.
Ability to pass CJIS background check.
Ability to manage multiple competing priorities and deadlines in a fast-paced working environment.

Nice To Haves

Computer Information Systems Security Professional (CISSP) or a related information security or computer forensics certification.
Higher Education experience.

Responsibilities

Provides advanced technical leadership for enterprise security operations across hybrid on premises and cloud environments.
Directs end to end vulnerability lifecycle management, coordinates complex incident response and digital forensics, and oversees continuous threat detection, containment, and remediation using both traditional security platforms and cloud native security services (e.g., AWS Security Hub).
Drives the architecture, automation, and optimization of security operations to ensure resilient, scalable, and intelligence driven protection aligned with institutional risk and compliance requirements.
Conducts advanced security audits and enterprise risk assessments across hybrid on premises and cloud environments.
Designs and implements technical safeguards to protect university systems, leveraging both traditional security technologies and cloud native security controls.
Provides expert level support for security tools and frameworks, performs deep dive analysis of intrusion artifacts and malware, and reconstructs attack timelines to identify indicators of compromise and strengthen detection and response capabilities.
Leads secure architecture design for major security and technology projects by evaluating, selecting, and engineering security solutions across hybrid on premises and cloud environments.
Ensures project designs incorporate appropriate security controls, architecture principles, and governance requirements, and provides expert direction on how security technologies should be implemented and integrated throughout the project lifecycle.
Conducts deep technical research and analysis of emerging security capabilities—both traditional and cloud‑native—to inform technology strategy and solution design.
Advises senior leadership and project teams on optimal approaches for implementing, integrating, and operationalizing security solutions to strengthen the institution’s overall security posture.
Manages complex system and information security incidents across on premises and cloud environments, including coordinating digital forensics investigations, analyzing cloud native logs and telemetry, and leading containment, eradication, and notification activities.
Leverages both traditional security tools and cloud native capabilities to investigate threats and ensure rapid, effective response.
Works with internal and external stakeholders on strategic security initiatives.
Collaborates with campus business units to manage information security risks and meet relevant compliance requirements, including conducting risk assessments, analyzing security threats, and advising on risk mitigation strategies aligned with institutional goals.
Develops and recommends updates to policies, standards, procedures, solutions and governance frameworks to address information security, compliance and privacy risks.
Contributes to documentation, training, and metrics gathering in support of the information security program.
Performs other duties as assigned.