Information Security Analyst

Information Security Analyst

The Information Security Analyst is responsible for the implementation of the Information Security Office governance, risk management, compliance, and awareness program. The position will conduct risk assessments; coordinate audit engagements with relevant parties; maintain policies, standards and procedures designed to safeguard information and resources; manage information security awareness training. In addition, conduct vulnerability assessments and security reviews through vulnerability scans and penetration tests to determine deviations from acceptable configurations, policies, and standards. Finally, the incumbent will assess levels of risk and recommend appropriate mitigation controls.

This position is classified as predominantly remote with occasional visits to campus as needed. Working hours will be based on Pacific Standard Time (PST).

The full salary range for the Information Security Analyst is $88,301.52 - $162,425.52 annually. However, the pay scale for this position is up to $121,785.30 annually. We base salary offers on a variety of considerations, such as education, licensure and certifications, experience, and other business and organizational needs.

Applicants must have current work authorization when accepting a UCR staff position. Currently, UCR is unable to sponsor or take over sponsorship of an employment Visa for staff.

As a University employee, you will be required to comply with all applicable University policies and/or collective bargaining agreements, as may be amended from time to time. Federal, state, or local government directives may impose additional requirements.

Educational Requirements

Bachelor's degree in related area and/or equivalent experience/training. - Required

Experience Requirements

Minimum of 4 - 7 years of related experience in information security, IT risk management, compliance, or a related field. - Required

Experience managing, configuring, or auditing security controls across multiple operating systems (e.g., Windows, Linux, UNIX). - Required

Experience conducting IT risk assessments or Third-Party Risk Assessments using industry-standard frameworks. - Required

Experience with security and privacy related regulations such as FERPA, HIPAA, PCI, etc. - Preferred

Experience designing, executing, or supporting cybersecurity awareness training or campus-wide outreach programs (such as phishing simulations). - Preferred

Experience working in higher education. - Preferred

Certification Requirements

Certified Information Systems Auditor (CISA) - Preferred

Certified Ethical Hacking (CEH) - Preferred

Security+ - Preferred

Certified Information Systems Security Professional (CISSP) - Preferred

Special Conditions

Must pass a background check. - Required

Occasional travel for university related business meetings, conferences and/or professional development. - Required

Travel Outside of Normal Business Hours - Required

Exercise the utmost discretion in managing sensitive information learned in the course of performing their duties. Sensitive information includes but is not limited to employee and student records, health and patient records, financial data, strategic plans, proprietary information, and any other sensitive or non-public information learned during the course and scope of employment. Understands that sensitive information should be shared on a limited basis and actively takes steps to limit access to sensitive information to individuals who have legitimate business need to know. Ensure that sensitive information is properly safeguarded. Follow all organizational policies and laws on data protection and privacy. This includes secure handling of physical and digital records and proper usage of IT systems to prevent data leaks. The unauthorized or improper disclosure of confidential work-related information obtained from any source on any work-related matter is a violation of these expectations. - Required

Minimum Requirements

Basic skill at reading and interpreting security logs.

Ability to follow department processes and procedures.

Interpersonal skills sufficient to work effectively with both technical and non-technical personnel at various levels in the organization.

Experience using IT security systems and tools. Knowledge of data encryption techniques. Experience analyzing logs for security breaches.

Demonstrated skills applying security controls to computer software and hardware.

Demonstrated skill at administering complex security controls and configurations to computer hardware, software and networks.

Knowledge of computer hardware, software and network security issues and approaches.

Demonstrated experience selecting and applying appropriate data encryption technologies.

Preferred Qualifications

Knowledge of other areas of IT, department processes and procedures.

Experience in incident response and digital forensics including data collection, examination and analysis.

Familiarity with leveraging Artificial Intelligence (AI) tools to automate or streamline administrative tasks, report writing, or content generation.