Senior Vulnerability Management Security Analyst

University of Colorado•Hybrid, CO

8d•$81,050 - $90,000•Hybrid

About The Position

The Senior Vulnerability Management Security Analyst will lead and continuously improve the University of Colorado Anschutz enterprise vulnerability management program. The role applies threat intelligence, advances security-by-design, and leads initiatives to strengthen security across a dynamic enterprise environment. As part of the collaborative Security Operations team, the analyst will proactively reduce risk and improve the university’s security posture while partnering across teams to protect systems supporting education, research, and patient care. The position is eligible for a hybrid work environment. Work may be performed predominantly remotely, with occasional in-person meetings or activities as needed; there is no minimum or prescribed in-person requirement. The schedule is based around core working hours in Colorado Mountain Time. The University of Colorado offers a comprehensive benefits package, including health, life, disability, dental and vision insurance; retirement plans; tuition benefits; paid vacation, sick leave and holidays; and an ECO Pass. The stated starting salary range is $81,050–$90,000. The position may be eligible for overtime compensation depending on its level. Applicants must be legally authorized to work in the United States without requiring sponsorship. The university conducts background investigations for prospective employees. Vaccination and occupational-health requirements may apply when working in affiliated healthcare facilities, certain research areas, or safety-sensitive duties.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Engineering, Business, Education, or a closely related field; four years of professional or high-level technical work experience may substitute for the bachelor’s degree, or an associate’s degree plus two years of relevant work experience may substitute.
2–4 years of relevant experience configuring and administering enterprise security vulnerability management tools and conducting cyber threat intelligence.
Experience overseeing security threat and vulnerability management programs.
Experience monitoring IT controls for regulatory and compliance requirements, such as NIST, CIS, SOX, HIPAA, HITRUST, SSAE 16 (SOC 1 and SOC 2), and PCI compliance (PCI DSS / PA-DSS).
Expert-level proficiency in a variety of vulnerability management technologies and principles.
Knowledge of regulatory requirements related to security, privacy, and data protection.
Excellent written and verbal communication skills.
Strong analytical and problem-solving skills, including interpersonal problem resolution.
Initiative and a proactive approach to workload management.
Ability to collaborate with stakeholders to develop solutions that meet requirements and desired outcomes.
Curiosity, motivation, and commitment to continuous learning and professional development.
Ability to build strong professional relationships and work collaboratively.
Self-starter with a can-do attitude; able to listen and provide solutions based on the needs and outcomes of those served.
High degree of integrity and ethical conduct, with secure and responsible professional practices.
Legal authorization to work in the United States without requiring current or future sponsorship.

Responsibilities

Lead and oversee the enterprise threat and vulnerability management program to ensure effective risk reduction across environments.
Evaluate and interpret threat data to assess risk and communicate recommended actions to stakeholders.
Drive remediation efforts in collaboration with IT teams, developers, and system owners.
Design and implement a vulnerability management strategy across on-premises and cloud environments, and track program metrics and outcomes.
Collaborate with incident response, vendors, and stakeholders to identify and address emerging threats and vulnerabilities.
Demonstrate integrity and ethical conduct, applying secure and responsible practices in professional activities, decision-making, and the use of information and technology.
Work collaboratively with stakeholders to develop solutions that meet defined requirements and desired outcomes.