Information Security Analyst

ON CAMPUS POSITION

The Information Security Analyst leads efforts to strengthen and maintain the college's cybersecurity posture through advanced technical expertise and strategic oversight. This role is responsible for managing security operations, implementing protective measures, ensuring compliance, and addressing risks to safeguard digital infrastructure and sensitive data. Collaborating closely with leadership and IT teams, the analyst also develops policies, coordinates incident responses, and supports a secure, resilient technological environment for students, faculty, and staff.

Essential Job Functions:

1. Strategic Security Planning and Policy Development

1. Develop and implement comprehensive cybersecurity strategies aligned with institutional goals.
2. Create, review, and enforce college information security policies, procedures, and guidelines.
3. Conduct regular risk assessments and provide detailed reports with recommendations to leadership.

1. Advanced Security Management

1. Administer and enhance security infrastructure, including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoint protection, and network access controls (NAC).
2. Lead the implementation of advanced encryption standards (e.g., PCI 3.2, FIPS 140-2) to protect data transmission.
3. Oversee the configuration, management, and optimization of security tools, including SIEM systems, vulnerability scanners, and endpoint security platforms.

1. Incident Response and Forensics

1. In coordination with the Information Security Director, the Information Security Analyst serves as the primary technical lead for security incident response, including investigation, documentation, and resolution of breaches or vulnerabilities.
2. Develop and execute forensic analysis processes, ensuring chain-of-custody protocols are followed.
3. Design and maintain an updated incident response plan, ensuring coordination between IT and college departments.

1. Risk Mitigation and Compliance

1. Align IT security controls with industry standards such as NIST, ISO, FERPA, HIPAA, GLBA, and PCI-DSS.
2. Analyze and mitigate security risks by conducting penetration tests and vulnerability assessments.
3. Monitor and respond to evolving federal and state cybersecurity laws and regulations.

1. Cybersecurity Awareness and Training

1. Expand and lead the college's Cybersecurity Awareness Program by developing training materials and conducting workshops for faculty, staff, and students.
2. Communicate technical security issues in a way that is understandable to non-technical stakeholders.

1. Technical Leadership and Project Management

1. Lead or collaborate on multiple security-related projects, including system upgrades, audits, and compliance initiatives.
2. Provide technical recommendations and mentorship to IT staff, interns, and colleagues.
3. Support the Director of Information Security at internal and external meetings, as required.

1. Threat Monitoring and Response

1. Analyze and address vulnerabilities identified through tools such as Vulnerability Scanners, SIEM, IDS, and other tools.
2. Monitor system logs and security alerts to identify potential threats and ensure timely remediation.
3. Design and implement proactive measures to protect against common attack vectors and indicators of compromise.
4. Analyze violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated.

1. Security Architecture and Integration

1. Collaborate with IT teams to design secure network and system architectures.
2. Evaluate new security technologies and oversee their deployment to meet organizational needs.
3. Manage and optimize cloud security for services such as Azure, AWS, or Google Cloud.
1. Perform other related duties as assigned.

Education Requirements:

• Associate's degree in related field required. Bachelor's degree preferred.

• Minimum of 3 years of network or security-related experience, including design, configuration, and incident response. Demonstrated expertise in managing security systems (firewalls, IDS/IPS, endpoint protection, etc.). Hands-on experience with vulnerability management, auditing tools, and SIEM platforms. Any equivalent combination of education and/or experience providing the knowledge/skills/abilities.

• CompTIA Security+, CISA, SSCP, GCIH, or equivalent.
• Commitment to pursuing advanced certifications (e.g., CISSP, CEH, or GIAC).