Cybersecurity Analyst II

The University of Texas at Austin is seeking an intermediate-level Cybersecurity Analyst II to help develop, maintain, and improve enterprise cybersecurity programs while executing day-to-day cybersecurity operations. In this role, you will support governance, risk, and compliance, align security activities with regulatory frameworks and operational and SDLC processes, and provide guidance to junior analysts.

This onsite position is based in Austin, TX. The salary is USD 77,930 per year plus an amount depending on qualifications.

What you’ll do

• Design and document program components for assigned cybersecurity domains, including policies, SOPs, playbooks, and runbooks for areas such as risk management, incident response, vulnerability management, and threat intelligence, aligned to organizational standards and regulatory frameworks.
• Implement automation and process improvements to strengthen domain controls, increase efficiency, and support continuous improvement.
• Maintain dashboards and performance metrics (for example, SLA compliance and control health) and incorporate lessons learned into program updates.
• Collaborate with IT and business stakeholders to integrate security requirements into operational processes and the software development lifecycle.
• Coordinate with department IT teams, campus IT, and the Information Security Office (ISO) to review, implement, and monitor security controls on campus-managed tools (examples include firewalls, DLP, and MFA) to protect digital infrastructure.
• Manage security investigations end-to-end and coordinate event resolution within scope.
• Maintain and refine playbooks and runbooks, proposing workflow improvements based on lessons learned.
• Apply policies, standards, and procedures, including control testing and collecting audit evidence.
• Monitor adherence to HIPAA, FERPA, PCI DSS, GDPR, ISO 27001, and NIST frameworks.
• Update risk registers, propose mitigations, and track remediation through closure.
• Conduct third-party and vendor security assessments against organizational standards and document follow-ups.
• Support awareness initiatives and tabletop exercises, including coaching during activities.
• Prepare reports with actionable recommendations for stakeholders and leadership.
• Partner with IT and project teams to embed security requirements into designs and changes, including reviewing changes for security impact.
• Maintain cybersecurity documentation (such as architecture diagrams, SOPs, and inventories) and represent the organization during audits and external assessments as assigned.
• Support disaster recovery and business continuity plan updates.

Investigation and decision-making

• Analyze complex issues methodically and derive evidence-based solutions.
• Correlate multi-source telemetry to isolate root causes, test alternatives, and select mitigations with minimal disruption.
• Capture decision rationale and lessons learned, weighing risk, impact, and tradeoffs to make timely decisions.
• Prioritize actions using severity and risk criteria, initiate containment under uncertainty, and adjust the approach as new artifacts surface.
• Enhance detections and enrichment workflows and execute investigations across OS/network/identity layers.

Requirements

• A Bachelor’s Degree in Cybersecurity, Information Technology, Computer Science or a related field, plus at least 3 years of cybersecurity experience (such as incident response, vulnerability management, threat monitoring).
• Demonstrated experience developing cybersecurity programs and associated tooling.
• Experience with risk and compliance frameworks (examples include NIST RMF, NIST CSF, ISO, HITRUST, and NIST 800-53).
• Strong knowledge of security protocols, network monitoring, and vulnerability assessment tools.
• Demonstrated experience in security incident detection, investigation, and response.
• Demonstrated knowledge of network protocols, operating systems, SIEM tools, and ITIL processes.
• Relevant education and experience may be substituted as appropriate.

Technologies

• SIEM/SOAR, endpoint, vulnerability scanners, firewalls, DLP, MFA
• NIST RMF, NIST CSF, ISO, HITRUST, NIST 800-53
• HIPAA, FERPA, PCI DSS, GDPR, ISO 27001, NIST
• ITIL
• ServiceNow Security Operations
• Security Incident Response

Certifications (required / preferred)

• Required: None
• Preferred: GIAC Certified Incident Handler (GCIH), Certified Incident Handler (ECIH), CISSP, CISM, CEH, or CompTIA Security+

Preferred qualifications

• At least 5 years of experience in network scanning, cloud security, RMF, threat intelligence programs, vulnerability management programs, security orchestration, automation, and response (SOAR) platforms.
• 4 years of healthcare experience, including knowledge of healthcare mission, HIPAA regulations, and medical device security considerations.
• Experience with ServiceNow Security Operations and Security Incident Response modules (or similar ITSM platforms).

Working conditions

• Standard office equipment
• Repetitive use of a keyboard
• May be exposed to occupational hazards including communicable diseases, blood borne pathogens, ionizing and non-ionizing radiation, hazardous medications, and disoriented or combative patients, or others

Application materials and checks

• Resume/CV
• 3 work references with contact information (at least one from a supervisor)
• Letter of interest
• A criminal history background check will be required for finalist(s)

Eligibility, verification, and compliance notices

• Participation in the Teacher Retirement System of Texas (TRS) is subject to the position being at least 20 hours per week and at least 135 days in length.
• If hired, completion of the federal Employment Eligibility Verification I-9 form is required, with acceptable original documents presented no later than the third day of employment.
• The university uses E-Verify for work authorization checks for new hires effective May 2015. Company ID number: 854197.
• Employees may be required to report violations of law under Title IX and the Jeanne Clery Act (Clery Act). Campus Security Authority notifications and resources will be provided if applicable.
• The Clery Act requires prospective employees be notified of the availability of the Annual Security and Fire Safety report.