Senior Information Security Analyst in Information Technology

Senior Information Security Analyst

UTHealth Houston is seeking an experienced Senior Information Security Analyst to help advance and strengthen its enterprise information security program in support of its healthcare, education, and research missions. In this role, you will lead the design and enhancement of key security infrastructure capabilities, including VPN, WAF, NGFW, and cloud security, among others. You will also contribute to enterprise initiatives while serving as a subject-matter expert on critical information security-related systems. Ideal candidates bring experience in DevSecOps, CI/CD security, secure remote access solutions, and automation. This is an opportunity to make a meaningful impact in a collaborative, mission-driven environment.

What we do here changes the world. UTHealth Houston is Texas's resource for healthcare education, innovation, scientific discovery, and excellence in patient care. That's where you come in.

Once you join us, you won't want to leave. It's because we reward our team for the excellent service they provide. Our total rewards package includes the benefits you'd expect from a top healthcare organization (benefits, insurance, etc.), plus:

• 100% paid medical premiums for our full-time employees
• Generous time off (holidays, preventative leave day, both vacation and sick time – all of which equate to around 37-38 days per year)
• The longer you stay, the more vacation you'll accrue!
• Longevity Pay (Monthly payments after two years of service)
• Build your future with our awesome retirement/pension plan!

We take care of our employees! As a world-renowned institution, our employees' wellbeing is important to us. We offer work/life services such as...

• Free financial and legal counseling
• Free mental health counseling services
• Gym membership discounts and access to wellness programs
• Other employee discounts, including entertainment, car rentals, cell phones, etc.
• Resources for child and elder care
• Plus many more!

Position Summary:

Responsible for designing, implementing, and monitoring the IT security program with a focus on identifying server/web vulnerabilities, security awareness, Identity and Access Management (IAM), and implementation of information security solutions in support of the Information Security program and other supervisory responsibilities as assigned.

Position Key Accountabilities:

• Provides technical leadership and support in the selection, configuration, and maintenance of security and IAM software, utilities, and hardware.
• Manages projects and supervises Information Security Staff and/or resources as relating to departmental projects and key initiatives as required by the Chief Information Security Officer.
• Maintains current understanding of IT audit techniques, information security, and IAM best practices, policies, and procedures, including Federal, State, and other applicable regulatory requirements and guidelines (HIPAA, FERPA, NIST, PCI DSS, TAC 202).
• Evaluates cost-effective alternatives to current information security program components.
• Participates in annual review of all information security policies, standards, procedures, and guidelines; recommends amendments; assures alignment with current regulatory requirements.
• Monitors and enforces compliance with information security policies, standards, procedures, and guidelines.
• Responsible for developing, implementing, and maintaining an ongoing IT security awareness and employee training program for the entire UTHSC-H.
• Conducts risk and security assessments, facilitates disaster recovery planning, and supports business continuity efforts for business-critical systems. Evaluates results with system owners and custodians.
• Provides information security consulting on a variety of technologies and processes.
• Performs periodic penetration tests and vulnerability scans. Reviews results for evidence of vulnerability or compromise; assists in or facilitates the implementation of the resolution. Track resolution of findings and prepare reports.
• Manages enterprise configuration/vulnerability management program, web application firewalls, and security scans to identify and correct security gaps. Prepares remediation reports and provides technical mentorship and guidance for various levels of operations staff.
• Participates, develops, and facilitates activities in support of Computer Security Incident Response Team (CSIRT) efforts. Coordinates initial assessments, including severity, potential impact, and resolution efforts with fellow CSIRT members.
• Provides guidance on integrating IAM tools and automation into new and existing applications.
• Works with clinical, academic, and administrative application groups to design, develop, and deploy IAM integration and automation solutions with minimum supervision.
• Provides support for enterprise account life-cycle management, including, but not limited to, account provisioning, account de-provisioning, authentication, and authorization.
• Provides support, configuration, and maintenance for the IAM infrastructure, including, but not limited to, IDM, AM, SSO, Federated Authentication, LDAP, IAM application development, and support tools.
• Provide support for the Public Key Infrastructure system and process.
• System administration for a variety of Linux and Windows-based servers to support security and IAM tools.
• Monitors system log information for evidence of compromise; responds to and reports security incidents.
• Provides forensic analysis and support for compliance and other security-related investigations; provides summary analysis as necessary.
• Initiates and participates in periodic security audits; tests controls; prepares reports and makes recommendations as necessary.
• Performs other duties as assigned.

Certification/Skills:

• Complex problem-solving skills; ability to think independently as well as work in a dynamic team.
• Ability to work within tight deadlines; strong organizational skills.
• Excellent verbal and written communication skills.
• Ability to configure and administer Windows and VMware servers and desktops.
• Working knowledge of UNIX-based systems.
• Web application security; programming, Linux system administration, database administration.
• Network architecture design; incorporating security into SDLC.
• Training in information technology required.
• Certified Information Systems Security Professional (CISSP) by the International Information System Security Certification Consortium, Inc. (ISC2) preferred
• Certified Information Systems Auditor (CISA) by ISACA preferred
• Certified Information Security Manager (CISM) by ISACA preferred

Minimum Education:

Bachelor's Degree required, or you may substitute required education with equivalent years of experience beyond the minimum experience requirement.

Minimum Experience:

2 years of experience in information technology support or information technology auditing required 1 year to two years of direct involvement with security platforms deployed as part of an enterprise-level information security program required

Physical Requirements:

Exerts up to 50 pounds of force occasionally and/or up to 20 pounds frequently and/or up to 10 pounds constantly to move objects.

Security Sensitive:

This position is a security-sensitive position pursuant to Texas Education Code §51.215 and Texas Government Code §411.094. To the extent that a position requires the holder to research, work on, or have access to critical infrastructure as defined in Texas Business and Commerce Code §117.001(2), the ability to maintain the security or integrity of the infrastructure is a minimum qualification to be hired for and to continue to be employed in that position. Personnel in such positions, and similarly situated state contractors, will be routinely reviewed to determine whether things such as criminal history or continuous connections to the government or political apparatus of a foreign adversary might prevent the applicant, employee, or contractor from being able to maintain the security or integrity of the infrastructure. A foreign adversary is a nation listed in 15 C.F.R. §791.4.

Residency Requirement:

Employees must permanently reside and work in the State of Texas.