Information Security Analyst II

We need to output HTML fragment with sections: h3 for headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections when posting has real specific content. We must preserve all substantive info, not invent or summarize away detail. Remove boilerplate: equity statement, EEO, etc. Also remove navigation, legal, application instructions, etc. Keep job summary, responsibilities, required education/experience, preferences, time base, work schedule, pay range, benefits, additional info maybe? But we must not include sections like "Additional Information" unless it's one of allowed headings. The allowed headings list: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We can map content accordingly. We need to decide what goes where. Job posting includes: - "Our Commitment To Equity, Diversity, And Inclusion" (boilerplate) remove. - "Job/Department Summary": Under general supervision of the ISO, the Information Security Risk Analyst provides functional governance, risk and compliance (GRC) reporting, oversight and user support for critical campus systems, data repositories, business processes, critical vendors, and partner operations that impact information security and compliance. This position is responsible for ongoing cyber risk management assessment and reporting, IT risk assessment and reporting, critical vendor risk monitoring and serves as the point of contact for information security governance and compliance related issues. Additionally, this position is responsible for managing GRC tools, software, risk assessments, and providing necessary training for end users in support of state and/or locally mandated cyber and information security directives. That's responsibilities. So we can put under

Responsibilities

with

• items. - "Required Education And Experience": Equivalent to a bachelor’s degree in a related field. Relevant education and/or experience which demonstrates acquired and successfully applied knowledge and abilities shown above may be substituted for the required education on a year-for-year basis. AND Two years of relevant experience. That's requirements/qualifications. Could be under

  Requirements

  or

  Qualifications

  . We need to decide. Probably Requirements for education/experience, Qualifications for preferences? But we can combine. - "Preferences": Preference may be given to applicants with the following as they may be considered specialized skills: list of items. That could be under

  Qualifications

  or

  Skills

  . Since it's preferences, maybe Qualifications. - "Time Base: Full-time Pay Plan: 12/12 Work Schedule: Mon-Fri 8:00am-5:00pm, Summer: Mon-Thurs 7:00am-5:30pm" That gives schedule and pay plan. Pay Plan: 12/12 maybe indicates monthly? Not pay amount. Then later: "CSU Classification Salary Range: $77,904 (Step 1) - $113,496 (Step 20) per year." That's pay. - "Benefits: This position qualifies for benefits including tuition fee waiver (if eligible). CSU, Chico offers a number of benefits to its employees (e.g., sick leave, vacation, health insurance). For more information please visit ..." That's benefits. - Additional Information includes background check etc. That's not in allowed headings; maybe we can drop or incorporate into Requirements? But it's not exactly required education/experience. It's additional info like background check, sensitive position, etc. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we need to keep that info somewhere. But we cannot create new headings outside allowed list. We could incorporate into a

  under an existing heading like Requirements or Qualifications, or maybe under About the role? But About the role is for description of role, not background check. Perhaps we can put under Requirements as additional requirements (like background check). Or we could create a

  About the role

  and include the job/department summary there, and then responsibilities separate? Actually the job/department summary is essentially about the role. So we could put that under About the role. Then Responsibilities separate? But the summary already includes responsibilities. To avoid duplication, we could treat About the role as a brief overview, and Responsibilities as detailed list. But we must not repeat content. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we need to keep all info, but we can organize. We could do:

  About the role

  Under general supervision of the Information Security Officer (ISO), the Information Security Risk Analyst provides functional governance, risk and compliance (GRC) reporting, oversight and user support for critical campus systems, data repositories, business processes, critical vendors, and partner operations that impact information security and compliance. This position is responsible for ongoing cyber risk management assessment and reporting, IT risk assessment and reporting, critical vendor risk monitoring and serves as the point of contact for information security governance and compliance related issues. Additionally, this position is responsible for managing GRC tools, software, risk assessments, and providing necessary training for end users in support of state and/or locally mandated cyber and information security directives.

  Then Responsibilities maybe not needed if we already covered. But we could still have Responsibilities with bullet list derived from same content. However that would duplicate. Better to avoid duplication: maybe put the summary under About the role, and then Responsibilities as bullet list of specific duties (which is essentially same). Could split: About the role = overview, Responsibilities = bullet list of duties. That's okay as long as we don't lose info. The summary already includes duties; we can break into bullet list. Let's extract duties: - Provide functional governance, risk and compliance (GRC) reporting, oversight and user support for critical campus systems, data repositories, business processes, critical vendors, and partner operations that impact information security and compliance. - Ongoing cyber risk management assessment and reporting. - IT risk assessment and reporting. - Critical vendor risk monitoring. - Serve as point of contact for information security governance and compliance related issues. - Manage GRC tools, software, risk assessments. - Provide necessary training for end users in support of state and/or locally mandated cyber and information security directives. We can put those as
  • . Then Requirements: education and experience. - Equivalent to a bachelor’s degree in a related field. - Relevant education and/or experience which demonstrates acquired and successfully applied knowledge and abilities shown above may be substituted for the required education on a year-for-year basis. - Two years of relevant experience. We can put as
    . Qualifications (preferences): list: - Master’s Degree in Cybersecurity, Computer Science, information systems, or other job-related field - Experience working in information technology in a higher education setting - Experience in Information Security or risk management related position - Experience related to compliance frameworks (PCI-DSS, GLBA, HIPAA, and FERPA) - Experience with PeopleSoft security - Experience using vulnerability management software - Experience using GRC tools to track/monitor/report cyber risk - Experience performing third-party IT vendor security risk reviews - Information Security Certification (CISA, CRISC, CISM, CISSP, CGRC, or comparable cybersecurity, GRC, audit, or compliance certification) We can put as
    . Pay: Salary range: $77,904 (Step 1) - $113,496 (Step 20) per year. Also Pay Plan: 12/12 (maybe monthly). We'll include Pay section with that info. Schedule: Time Base: Full-time; Work Schedule: Mon-Fri 8:00am-5:00pm, Summer: Mon-Thurs 7:00am-5:30pm. Benefits: tuition fee waiver (if eligible); sick leave, vacation, health insurance; link to benefits summary. Additional Information: background check etc. We need to preserve. Could we put under Requirements as additional requirements? Or maybe under Qualifications? It's not a qualification but a condition. Perhaps we can add a

    About the role

    and include that info there? But it's not about role. Maybe we can add a

    Requirements

    and include bullet items for education/experience and also background check etc. That would be mixing but still preserving. Better: create a

    Requirements

    for education/experience, and a

    Additional Requirements

    not allowed. So we must fit into allowed headings. Could we put under Qualifications? It's not a qualification but a condition. However the instruction says "include a section ONLY when the posting has real, specific content for it". It doesn't forbid using a heading for content that is not exactly matching the heading name, as long as we have real content. But headings are prescribed: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we must use those exact headings. We can decide to put background check under Requirements (makes sense as a requirement). Or under Qualifications (maybe as a qualification). I'd put under Requirements. Thus Requirements will contain: - Equivalent to a bachelor’s degree in a related field. - Relevant education and/or experience which demonstrates acquired and successfully applied knowledge and abilities shown above may be substituted for the required education on a year-for-year basis. - Two years of relevant experience. - Must successfully complete a background check (including criminal records check, sexual offender registry check, and/or fingerprinting) prior to assuming position. - Position is considered sensitive; incumbent responsible for safety and security of Level 1 data. We can also include the disclosure about sexual harassment etc. That's also a requirement. So add: - Applicants will be required to disclose whether they have received a final administrative or judicial decision determining sexual harassment within the last 7 years after meeting minimum qualifications and before offer. - Applicants reaching final stages must sign a release form authorizing release of information by current/former employers regarding substantiated allegations of misconduct. We'll include those. Now Skills: we haven't used Skills heading. Could we put the preferences under Skills? The preferences list includes experience and certifications, which could be considered skills. But we already used Qualifications for preferences. We could instead put preferences under Skills, and keep Qualifications empty? But we must only include sections when posting has real content. So we need to decide which headings to use. We have content for About the role, Responsibilities, Requirements, Benefits, Pay, Schedule. That's six sections. We could also add Qualifications if we have content distinct from Requirements. But we could merge preferences into Skills. Let's see: Skills heading could contain the list of specialized skills: Master's degree, experience in IT higher ed, InfoSec/risk management, compliance frameworks, PeopleSoft security, vulnerability management software, GRC tools, third-party vendor reviews, certifications. That seems appropriate for Skills. Thus: - About the role: overview paragraph. - Responsibilities: bullet list of duties. - Requirements: education/experience + background check etc. - Skills: preferences list. - Benefits: benefits info. - Pay: salary range + pay plan. - Schedule: work schedule. That covers all content. No need for Qualifications heading. Now ensure we don't include boilerplate: equity statement, EEO, etc. Also remove navigation, legal, application instructions, etc. Also remove the "Open Until Filled" etc. That's application instruction; remove. Also remove the "Additional Information" heading we are not using; we incorporated its content into Requirements. Now produce HTML fragment: no or . Just the sections. We'll need to wrap each section in appropriate tags:

    Heading

    then either

    for prose or

    • for lists. For About the role: we have a paragraph (maybe multiple sentences). Use

      . For Responsibilities:

      • each duty. For Requirements:
        • each item. For Skills:
          • each