Cybersecurity Analyst Tier 3

Position Overview

The University of Utah has an opportunity for a Cybersecurity Analyst Tier 3 (Security Operations Center) to support Information Security and Compliance goals. In this role, you will serve as the senior escalation point within the Security Operations Center, leading complex investigations while advancing detection engineering, automation, and continuous improvement initiatives. The position combines investigative depth with hands-on technical capability to improve detection fidelity, reduce response times, and strengthen overall security.

About the Team

University Information Technology (UIT) is the central IT service provider for the University of Utah. UIT reports to the U’s Chief Information Officer and supports shared IT services including the wired and wireless network; Campus Information Services (CIS) portal; UMail, telephone, and online collaboration; digital learning technologies; information security; software licensing; and other IT systems and services.

The University of Utah is located in Salt Lake City. As the flagship institution of the State of Utah’s higher education system, it includes arts and museum venues and is a member of the BIG-12 Conference. Skiing and snowboarding opportunities are close to campus, and there are many options for outdoor activities such as biking, hiking, and fishing. Salt Lake City also offers cultural and recreational events, including the Utah Symphony and Opera, Ballet West, professional sports teams, and more.

Responsibilities

Incident Response

• Lead the end-to-end incident response lifecycle, including triage, investigation, containment, eradication, and post-incident analysis across endpoint, network, cloud, and identity domains.
• Act as the senior escalation point for Tier 2 analysts, providing technical direction and oversight for complex investigations.
• Conduct digital forensics to support root cause analysis, adjust security detections to address identified gaps, and develop post-incident action plans.

Detection Engineering

• Own detection strategy and coverage across key threat domains.
• Define telemetry requirements in partnership with security engineering and platform owners.
• Lead development of detection standards and quality metrics.
• Design and maintain detection logic across SIEM, EDR, and cloud platforms, ensuring high-fidelity alerting through tuning, enrichment, and correlation of multi-source telemetry.
• Identify detection gaps based on relevant cybersecurity threat intelligence and through the incident response lifecycle.
• Design, build, and maintain automation (SOAR) to improve triage, data enrichment, and response efficiency.
• Operationalize threat hunting and incident findings into scalable detection use cases and playbooks.

Threat Analysis

• Lead hypothesis-driven threat hunting campaigns informed by threat intelligence, transforming findings into durable detections and response playbooks.
• Conduct proactive threat hunting to uncover advanced adversarial activity not detected by existing controls.
• Analyze attacker behavior and map findings to known tactics, techniques, and procedures (TTPs).
• Continuously evaluate detection coverage by proactively reducing false positives and increasing detection quality.

Leadership

• Assist in mentoring and developing Tier 1/2 SOC analysts; conduct periodic investigation reviews to ensure quality.
• Drive improvements in SOC processes, workflows, and incident response playbooks.
• Produce clear, actionable after-action reports and executive-ready summaries for findings.
• Partner with internal IT teams to improve logging, telemetry, and observability across the environment.

Minimum Qualifications

Equivalency Statement: 1 year of higher education can be substituted for 1 year of directly related work experience (Example: bachelor’s degree = 4 years of directly related work experience).

Department may hire at one of the following job levels:

• Information Security Analyst, IV: Requires a bachelor’s (or equivalency) + 8 years or a master’s (or equivalency) + 6 years of directly related work experience.
• Information Security Analyst, V: Requires a bachelor’s (or equivalency) + 10 years or a master’s (or equivalency) + 8 years of directly related work experience.
• Information Security Analyst, VI: Requires a bachelor’s (or equivalency) + 12 years or a master’s (or equivalency) + 10 years of directly related work experience.
• Information Security Analyst, VII: Requires a bachelor’s (or equivalency) + 14 years or a master’s (or equivalency) + 12 years of directly related work experience.

Preferred Qualifications

• Strong operational security background.
• Experience conducting hands-on analysis of large volumes of logs, network data, and other attack artifacts during incident investigations.
• Extensive experience leveraging SIEM and SOAR platforms to analyze diverse log types and events across multiple data sources, applying behavioral, statistical, and machine learning techniques to detect and respond to advanced threats.
• Strong understanding of the network threat lifecycle, attack vectors, and exploitation methods, including intrusion set tactics, techniques, and procedures (TTPs).
• Experience monitoring, defending, and administering cloud environments (e.g., AWS, Azure, GCP), including the use of cloud-native security tools and strategies to protect data, as well as identifying and mitigating cloud-specific threats.
• Proficiency in scripting and programming.

Work Details

• Location: Campus, Salt Lake City, UT
• Department: 00954 - UIT Systems & Security
• Schedule: Monday through Friday, 9 a.m. to 5 p.m., with on-call responsibilities for after-hours, weekends, holidays, etc.
• Hours: 40 hours per week
• Full Time or Part Time: Full Time
• Shift: Day
• Type of Recruitment: External Posting
• Pay Rate Range: $100,000 to $140,000

Dates and Administrative Information

• Open Date: 10/27/2026
• Close Date: 11/30/2026
• Priority Review Date: Note: Posting may close at any time
• Requisition Number: PRN46602B
• Working Title: Cybersecurity Analyst Tier 3
• Career Progression Track: P00
• Track Level: P7 - Senior Principal, P6 - Principal, P5 - Expert, P4 - Advanced
• FLSA Code: Computer Employee
• Patient Sensitive Job Code: No

Additional Information

• University participating employer with Utah Retirement Systems (URS). Eligible new hires with prior URS service may elect to enroll in URS if the election is made before they become eligible for retirement (usually the first day of work). Contact Human Resources at (801) 581-7447 for information.
• Individuals who previously retired and receive monthly retirement benefits from URS are subject to URS post-retirement rules and restrictions. Contact Utah Retirement Systems at (801) 366-7770 or (800) 695-4877, or University Human Resource Management at (801) 581-7447.
• This position may require successful completion of a criminal background check and/or drug screen.
• The University values candidates with experience working in settings with students and a strong commitment to improving access to higher education.
• Veterans’ preference is extended to qualified applicants, upon request and consistent with University policy and Utah state law.
• Reasonable accommodations in the application process will be provided to individuals with disabilities upon request.
• The University of Utah does not discriminate based on race, ethnicity, color, religion, national origin, age, disability, sex, sexual orientation, gender, gender identity, gender expression, pregnancy, pregnancy-related conditions, genetic information, or protected veteran’s status.