IT Risk & Information Security Analyst

Princeton University Services is seeking an IT Risk & Information Security Analyst to help protect critical campus services. This hybrid role partners across USIT, ISO, OIT, departmental leaders, and operational teams to strengthen IT risk management, information security, and data privacy programs, while supporting mission continuity through incident readiness and resilient recovery planning.

Responsibilities

• Lead system and data security initiatives, including security architecture reviews, access audits, vulnerability management, remediation tracking and coordination, evidence collection, monitoring, and reporting to drive continuous risk reduction aligned with University Services systems and compliance needs.
• Support compliance efforts across applicable regulations, standards, and University policies, with privacy-aware handling of sensitive and regulated data including FERPA, GDPR, CCPA, and PCI.
• Conduct IT risk assessments, privacy reviews, and business impact analyses to identify threats, evaluate operational impacts, prioritize mitigations, and improve resilience for critical functions.
• Collaborate with USIT, ISO, OIT, and departmental teams on data classification and responsible data handling, including retention, access management, endpoint protection, and secure system operations.
• Perform or coordinate security testing and vulnerability scanning, ensure remediation follow-up, and provide reporting using appropriate tools, dashboards, and automation.
• Develop, maintain, and test mission continuity and disaster recovery plans for University Services functions, systems, applications, and data.
• Act as the primary University Services point of contact for security incidents, coordinating response, escalation, remediation, communication, post-incident review, and improvement actions.
• Design and deliver security and data privacy awareness training for staff, translating policies, threats, and best practices into practical guidance for diverse audiences.
• Prepare concise reports, metrics, briefings, and recommendations that help leadership understand risk, track progress, and support decision-making.
• Contribute to special projects as assigned.

Requirements

• 5+ years of relevant professional, hands-on experience in IT risk management and/or information security.
• Experience with security incident response and management.
• Familiarity with regulatory requirements and compliance standards.
• Knowledge of data classification and management practices.
• Knowledge of data privacy principles, privacy-aware data handling, and requirements for sensitive and regulated data.
• Proficiency in security testing tools and methodologies, including vulnerability scanning and penetration testing, and static and/or dynamic code analysis.
• Experience with security operations tools, automation technologies, dashboards, reporting platforms, and workflow systems to improve risk tracking, audit readiness, and remediation follow-through.
• Strong knowledge of security and privacy frameworks and best practices.
• Ability to work collaboratively with cross-functional teams.
• Strong communication and interpersonal skills, including maintaining positive professional relationships and addressing conflicts appropriately.
• Ability to work with complex confidential information using discretion and judgment.
• Excellent written and oral communication skills for presenting findings to leadership.
• Strong organizational skills to manage multiple projects, adapt to shifting priorities, and meet deadlines.
• Ability and drive to stay current with the rapidly evolving risk and information security landscape and report on changes.

Preferred Qualifications

• Relevant and active certifications such as CISSP, CISM, CISA, or Security+.
• Professional experience in a higher education environment.
• Experience with FERPA.
• Experience with PCI DSS.
• Experience with privacy, data governance, data classification, or responsible data use initiatives in a complex organization.
• Experience developing scripts, integrations, reports, or automated workflows to reduce manual effort and improve risk, security, compliance, or privacy processes.
• Experience training and improving others’ understanding of risk and information security.

Location: Princeton, NJ (hybrid).
Education: Bachelor’s degree in Information Technology, Cybersecurity, or a related field.
Note: A cover letter is required for full consideration.