Information Security Analyst

About the role

We are seeking a talented Information Security Officer to play a vital role in our dynamic and close-knit team within the Information Security Office. In this essential position, you will lead initiatives to protect our digital resources, developing and implementing innovative security strategies to effectively mitigate risks. Your expertise will contribute to maintaining a secure and resilient environment for education, research, and healthcare.

The Information Security Office is a high-profile team with university-wide purview, offering opportunities to share and shine. We operate with a high degree of autonomy, expecting each contributor to bring their unique talents to address the university's tough challenges. The Cybersecurity Governance, Risk, and Compliance (GRC) team is an innovative, newly formed team with an entrepreneurial spirit, inviting you to help us grow while advancing your career.

Responsibilities

• Support the research community by providing guidance on information security matters, collaborating with local client IT groups and Research Computing to implement and improve security measures that meet NIST 800-171 standards.
• Execute a strategy to prepare the university for security audits and changing regulatory requirements, particularly focusing on Cybersecurity Maturity Model Certification (CMMC) and NIST 800-171 standards.
• Assess the university's current security practices and identify gaps affecting compliance.
• Implement best practices and guidelines to strengthen cybersecurity measures and support audit preparations.
• Develop and deliver an awareness and training program aligned with NIST to foster a culture of security awareness and responsibility.
• Review and update security policies and procedures to meet NIST requirements and reflect best practices in cybersecurity.
• Monitor security controls and risk management practices, regularly evaluating the effectiveness of existing security measures.
• Prepare and maintain documentation related to security policies, procedures, and compliance efforts, including risk assessments and operational reports.
• Collaborate with cross-functional teams (IT, Finance, Human Resources, Legal) to integrate information security into the organization's overall risk management program.
• Stay abreast of industry trends, emerging threats, and evolving regulatory requirements to inform security practices and compliance strategies.
• Perform other related duties to support the organization's information security program.

Qualifications

• Bachelor’s degree (or equivalent experience) in a relevant field.
• Minimum of three years of experience in information security, risk management, or compliance.
• Experience with industry standards and regulations, particularly NIST and HIPAA.
• Strong analytical and problem-solving skills, with the ability to identify and assess security risks.
• Exposure to security audits, risk assessments, or vulnerability assessments.
• Knowledge of security technologies such as encryption, firewalls, intrusion detection systems, and SIEMs.
• Experience working as part of a team in cybersecurity, information security, assurance, or related fields.
• Ability to communicate complex technical information clearly to diverse audiences with varying technical expertise.
• Ability to stay current with the latest security threats, technologies, and industry regulations.

Skills

Bonus Points:

• Knowledge of ISO 27001 and PCI DSS.
• Security+ or other professional cybersecurity certifications.
• Proficiency in setting up and managing a learning management system (LMS), including course creation and configuration.
• Prior work in a highly regulated industry or higher education.

Schedule

This position is eligible for permanently remote work. The team operates on Pacific Time, and occasional on-campus visits (a few days per quarter) may be required. Travel expenses will be covered for those outside the greater Bay Area.