Enterprise Information Security Analyst

Job Posting Title:

Enterprise Information Security Analyst

----

Hiring Department:

Dell Medical School

----

Position Open To:

All Applicants

----

Weekly Scheduled Hours:

40

----

FLSA Status:

Exempt

----

Earliest Start Date:

Immediately

----

Position Duration:

Expected to Continue

----

Location:

UT MAIN CAMPUS

----

Job Details:

General Notes

The Office of Information Technology at the Dell Medical School is looking for an Enterprise Information Security Analyst.

The Enterprise Information Security Analyst will assist with meeting the requirements of all four domains: Security Oversight, IT Risk Assessment, Security Engineering, and Security Operations and focus in depth upon the domain requirements of Security Operations and IT Risk Assessment.

Purpose

Under the direction of the Manager of Enterprise IT Security and Operations within the Office of the Executive Director of Strategic Initiatives and Deputy CISO, the Enterprise Information Security Analyst will work closely with the Enterprise Cybersecurity Architect to perform IT security analysis and assessments in accordance with established procedures and protocols. The position will ensure the demonstrable Confidentiality, Integrity, and Availability (CIA) of the University of Austin Dell Medical School’s information assets for authorized internal and external users by reviewing, validating, classifying, and responding to security events and cyber-attacks.

Responsibilities

• Develop and maintain security policies, procedures, and standards to establish best practices and ensure compliance with industry standards and regulations, such as HIPAA, FERPA, PCI DSS, and GDPR. Create and maintain a complex variety of security and risk documentation (e.g., Policies, process diagrams, risk registers, etc.) that may be shared with various audiences.

• Research and analyze cybersecurity emerging threat indicators, vulnerabilities, latest cybersecurity technologies, and trends in the industry to recommend threat mitigation strategies for enhancements or countermeasures to mitigate risks and technologies to improve security posture.

• Stay abreast of external regulations, data security/privacy standards, and relevant data/breach notification and laws applicable to healthcare and higher education assess potential risks; translate appropriate information security and data privacy requirements into coherent policy and data management processes.

• Install, upgrade, maintain and monitor information security-related systems. Participate in business continuity and disaster recovery planning.

• Monitor, queries, and analyze security events and incidents using security information and event management (SIEM) tools to identify potential security threats and vulnerabilities.

• Monitor, investigate, analyze, assess cybersecurity incidents, cybersecurity breaches, and alerts from vendors’ cybersecurity advisories, cybersecurity tools, audit logs, network devices, and information systems to detect and respond to suspicious/malicious activities. Prepares cybersecurity breaches, incidents, and alerts reports. Ability to anticipate cyber-attacks.

• Conduct cybersecurity audits, assessments, and support ongoing audit requirements for all systems to identify and remediate security vulnerabilities in information systems, applications, and infrastructure.

• Collaborate with cross-functional teams, including IT, operations, and compliance. Work with security team(s) to perform tests and uncover network vulnerabilities to maintain a high-security standard. Identify ongoing threats to remote computers and protect against new exploits. Protect expanded attack surfaces due to increased telework.

• Participate in review of third-party vendor services/contracts (applications, hosting, systems, etc.) that involve the collection, processing, transmission, or storage of all data types defined by the University’s Data Classification standards; develop and implement an ongoing supporting documentation.

• Participate in security awareness training to promote a culture of security awareness and compliance among employees. Assist in cultivating a risk aware culture through outreach and education.

• Other related duties as assigned.

Required Qualifications

Bachelor's degree plus 4 years of progressive experience working in information technology, security, or risk management. Comparable success and work experience may be considered in lieu of degree requirement. CompTIA Security + or other industry related certifications. Must possess a high degree of i