Senior Security Analyst - GRC: Office of Innovative Technologies - UTK

The Senior IT Governance, Risk, and Compliance (GRC) person will lead large-scale projects, security assessments, compliance audits, and risk management initiatives across the UTK environment and other campuses. This high-level role involves developing, maintaining, and overseeing the UTK IT GRC program as part of the Information Security Office (ISO). This program encompasses multiple federal and state compliance frameworks, including the Center for Internet Security (CIS), Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, PCI DSS, HIPAA, and NIST standards.

IT Governance, Risk, and Compliance (GRC) Leadership

• Provide strategic leadership in developing and guiding the IT Governance, Risk, and Compliance (GRC) program for the University of Tennessee.
• Guide the implementation of a GRC application for UTK and statewide campuses, ensuring alignment with risk management objectives across all campuses and institutes.
• Execute a comprehensive risk assessment program to be utilized by all campuses, assigning clear accountability for risk mitigation tasks.
• Mentor and train junior-level GRC analysts. 

Risk Assessment and Mitigation

• Conduct detailed risk assessments for campuses, departments, enterprise systems, and statewide systems, departments, or applications upon request.
• Develop and implement robust reporting processes to monitor and communicate risk mitigation efforts across the university system.

Regulatory Compliance

• Lead technical assessments and compliance initiatives.
• Drive compliance efforts for the university.

Security Controls Accountability

• Take direct responsibility for assessing security controls applied to applications, systems, networks, and databases.
• Ensure all risk mitigation efforts related to applications, systems, networks, and databases are effectively executed.
• Maintain accountability for compliance with the Center for Internet Security (CIS) Critical Security Controls.

Statewide Engagement

• Travel to campus and institute locations statewide to provide hands-on support and ensure consistent implementation of GRC initiatives across all entities within the university system.

This role requires a high level of expertise in governance frameworks, risk management methodologies, regulatory compliance standards, and the implementation of security controls. The successful candidate will serve as a strategic leader driving systemic improvements in IT governance and security across the University of Tennessee System.

Required Qualifications

Education: High school diploma 

Experience: 7 years of relevant experience

Knowledge, Skills, Abilities: 

• Knowledge of advanced security concepts and enterprise responses
• Ability to produce highly technical reports and communicate importance to stakeholders
• Knowledge of Cloud security concepts
• Ability to correlate current security trends into protection mechanisms
• Ability to work independently and keep leadership informed of progress
• Advanced organization, communication, analysis, and troubleshooting skills

 

Preferred Qualifications

Education: Bachelor's Degree

Experience: 10 years of relevant experience

Knowledge, Skills, Abilities: 

• Certifications - CISSP, CISA, CISM, SSCP, CASP, CRSIC, etc.
• Ability to interface with senior technical and business management
• Ability to create, communicate, and maintain policy/program-level documents
• Experience or certifications related to CIS Critical Security Controls

 

Work Location:

This position is based at the UT Knoxville campus and follows a hybrid work schedule, with two in-office days and three remote workdays per week. The specific schedule may vary or include periodic overnight travel to other campuses, depending on project requirements and meeting commitments.

Compensation and Benefits:

• UT market range: MR-16
• Anticipated hiring range: $100,000 to $108,000 annually
• Find more information on the UT Market Range structure here