Cybersecurity Risk Analyst IV

About the Role

The IT Risk Analyst IV serves as a professional-level position in Information Security within UF Information Technology (UFIT). This senior role in the Information Assurance team focuses on conducting information security risk assessments, providing guidance for secure technology and process implementation, and improving the university’s risk assessment methodologies to protect UF data and systems in compliance with laws, regulations, policies, and standards. The incumbent will also serve as a subject matter expert in information security, advising, documenting, training, and mentoring junior staff.

Responsibilities

• Executes the UF information risk assessment process, including:
  • Conducting risk assessments for internal information systems using established procedures and control baselines
  • Conducting risk assessments on third-party products and services
  • Developing remediation plans and recommendations for IT staff to address identified risks
  • Preparing executive-level residual risk reports to prompt risk disposition decisions
  • Guiding units in creating security plans for all systems
  • Establishing and maintaining a non-technical monitoring program for compliance and effectiveness of administrative processes and technical controls
• Consults on security systems, tools, and procedures to meet defined security requirements and goals:
  • Assisting units in selecting technology that aligns with UF’s IT environment and supports information security goals
  • Providing expert security guidance to help units improve security posture and reduce risk
  • Guiding units in developing processes and procedures to implement UF information security policies and standards
  • Producing and publishing documentation and guidance for complying with information security policies and standards
• Contributes to the development of the UF Information Security Risk Management program, including:
  • Evaluating and providing recommendations regarding legal, regulatory, and contractual information security compliance requirements
  • Serving as a subject matter expert on security control frameworks, establishing, and updating control baselines
  • Optimizing procedures used to conduct information security risk assessments
  • Contributing to the creation and modification of university information security policies and standards
  • Collaborating and advising on changes and improvements to the university’s Governance, Risk, and Compliance (GRC) platform
• Trains and mentors junior risk analysts, interns, and distributed university IT staff on the risk assessment process.
• Contributes content and collateral material to information security training and awareness programs.

Requirements

• Bachelor's degree in an appropriate area and four years of relevant experience; or a high school diploma or equivalent and eight years of relevant experience.
• Appropriate college coursework may substitute at an equivalent rate for the required experience but does not negate the minimum degree requirement(s).

Qualifications

Preferred Education & Training

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, or a related field.
• Global Information Assurance Certification (GIAC) Security Essentials (GSEC) or equivalent (preferred).
• Certified Information Systems Auditor (CISA) or equivalent (preferred).
• Certified Information Systems Security Professional (CISSP or equivalent) (preferred).

Preferred Experience

• Minimum of 10 years of combined IT and security experience with exposure to data, networks, systems, and web applications.
• Experience conducting cybersecurity risk assessments in large organizations.

Preferred Skills

• Excellent written and verbal communication skills; outstanding interpersonal skills.
• Ability to work collegially and interact effectively with all constituencies.
• Excellent organizational skills and ability to prioritize and complete simultaneous projects with minimal supervision.
• Accuracy, attention to detail, and a customer service-oriented approach.
• Advanced analytical thought, problem-solving, leadership, teambuilding, conflict resolution, strategic planning, management, and IT project management.
• Knowledge of security standards, applicable laws, and regulations (NIST, HIPAA, HITECH, PCI, FERPA, Florida Statutes).
• Understanding of security issues, techniques, and implications across all existing computer platforms.
• Familiarity with client/server, network topology, network/infrastructure security, network operating systems, web technologies, and e-commerce operations.
• IT auditing and risk management experience preferred.
• Broad knowledge of principles in a specialized field and awareness of current standards and trends in IT and emerging technology.

Abilities

• Work collaboratively and build strategic relationships with internal and external clients.
• Think critically and creatively, with a high standard of integrity and motivation to incorporate best practices into the organizational structure.

About UF Information Technology

Led by Senior Vice President and CIO Elias Eldayrie, UFIT comprises nine departments: Academic Technology; AI² Center; Applications, Development, and Integrations; Business Center; Customer Experience and Resource Planning; Data Platform and Analytics; Information Security Office; Infrastructure and Communication Technology; and Research Computing. UFIT enables teaching, learning, research, and service with state-of-the-art enterprise IT systems, including collaborations with SEC and SUS universities and the opportunity to teach using HiPerGator. For more information, visit UFIT Strategic Plan.

About The University of Florida

One of America’s top universities, the University of Florida drives future-making education, discoveries, life-saving healthcare, and community-building collaboration. Located in Gainesville, a city of approximately 150,000 residents in North-Central Florida, UF offers a mild climate and extensive parks and recreational areas for outdoor activities like hiking, biking, and nature photography. Gainesville is within a 2-hour drive of major metropolitan areas (Orlando, Tampa, Jacksonville) and is close to both the Gulf Coast and Atlantic Ocean. The university supports a vibrant community with large college sports programs, museums, and a performing arts center. Learn more at Visit Gainesville.

Benefits

UF provides various leave programs based on an employee’s salary plan, including vacation, sick leave, holidays, personal leave days, and paid family leave. The university offers a competitive benefits package.

Pay

$121,294 - $127,234; commensurate based on education and experience.

This position is not eligible for remote work and is located in Gainesville, FL. A Level 2 Criminal Background Screening is required. Work visa sponsorship is not available.