IT Security Risk and Compliance Analyst

About the role

Under the guidance of the Associate Director of IT Risk and Compliance, the IT Security Risk and Compliance Analyst will conduct IT security assessment activities—including risk assessments, security reviews, and evaluations of third‑party technology solutions—to ensure alignment with university policies, standards, and external compliance regulations.

Responsibilities

• Perform IT security assessments and risk assessments for university departments.
• Conduct security reviews of third‑party technology solutions.
• Develop and maintain asset inventories.
• Assess endpoint and application security controls and configurations.
• Examine security‑related procedures and documentation.
• Create and maintain documentation and procedures supporting the IT Risk and Compliance program.
• Identify and implement automation opportunities to improve data consistency and process efficiency.
• Provide training and outreach on security practices to the university community.
• Coordinate updates to the IT Continuity of Operations plan.
• Assist units within the Division of Information Technology with disaster recovery planning and other security‑related initiatives.

Required Qualifications

• Master’s degree, or equivalent combination of education, training, and progressive experience.
• Demonstrated experience performing IT security reviews, risk assessments, or audits.
• Strong understanding of key information security concepts and fundamentals.
• Experience creating awareness of security practices across multiple technical teams.
• Knowledge of security frameworks and standards (e.g., NIST, PCI‑DSS, ISO 27001, CIS Critical Security Controls, NIST Cybersecurity Framework).
• Ability to communicate effectively with a broad range of campus audiences.
• Exceptional organizational and time‑management skills.

Preferred Qualifications

• Professional certification such as CISA, CISM, CRISC, or CISSP.
• Experience performing security assessments of SaaS services.
• Knowledge of relevant compliance regulations (e.g., FERPA, GLBA).
• Experience with GRC and information security tools/technologies for collecting and maintaining security and risk information.
• Experience with automation using scripting tools (e.g., Python, PowerShell, Bash).
• Experience with data analysis and manipulation.
• Experience managing IT security risk or compliance in a higher‑education setting.

Work Location

Candidates must be available for on‑site work in Blacksburg, VA as needed, with at least one on‑site day per week.

Pay

$80,000 – $94,000

Schedule

40 hours per week. Exempt status – not eligible for overtime.

Additional Information

• Sponsorship is not available for this role.
• The successful candidate will be required to undergo a criminal conviction check.

About Virginia Tech

Dedicated to its motto, Ut Prosim (That I May Serve), Virginia Tech pushes the boundaries of knowledge through a hands‑on, transdisciplinary approach to preparing scholars to be leaders and problem‑solvers. As a comprehensive land‑grant institution, it enhances quality of life in Virginia and worldwide. The university enrolls more than 36,000 undergraduate, graduate, and professional students across eight undergraduate colleges, a school of medicine, a veterinary medicine college, a Graduate School, and an Honors College, with additional campuses and research sites throughout the state. Virginia Tech conducts over $650 million in research annually and supports professional development and shared governance opportunities for its community.