Senior Information Security Analyst

The Senior Information Security Analyst supports Texas Woman's University by analyzing information systems, security policies, and operational practices to identify control gaps, assess risk, and implement remediation. The role also coordinates compliance activities and advances security awareness and training across stakeholders.

Key Responsibilities

• Use cyber defense tools to provide continual monitoring and analysis of system activity to detect malicious behavior.
• Analyze identified malicious activity to determine exploited weaknesses, exploitation methods, and resulting impacts on systems and information.
• Review the enterprise architecture and related systems to understand criticality and data flows, and identify security control improvements that reduce exposure and vulnerable attack surface.
• Create, review, and maintain information security policy documentation aligned with university policies, Texas Administrative Code 202, and applicable state, federal, and industry regulations.
• Collaborate with ITS and functional area subject matter experts to validate events and alerts, triage security incidents, and identify needs for new or updated IT policies and awareness training.
• Coordinate with the university’s Compliance Officer regarding information security policy and policy compliance matters.
• Perform regular compliance audits based on defined administrative and operational requirements and escalate exceptions.
• Recommend security improvements by evaluating current conditions, assessing trends, and anticipating future requirements.
• Project manage requirements gathering, design, development, implementation, and delivery of security-related technologies and process improvements.
• Serve as project lead for security remediation resulting from internal or external audits, penetration testing, or other assessments.
• Provide timely IT security support, including responding to incident/problem tickets and troubleshooting cybersecurity-related errors and issues.
• Conduct and maintain risk assessments for new software, systems, or cloud-hosted service requests based on information security and data protection requirements.
• Participate in assessments and audits to determine compliance with regulatory and university requirements, including TAC 202, PCI, and HIPAA.
• Support the development and delivery of information security training and awareness campaigns as needed.
• Develop substantive reporting and briefing content related to policy, strategy, and audit or assessment activities.
• Keep ITS leadership informed by preparing performance reports and communicating system status.
• Maintain current awareness of security practices, future technology trends, and best practices, including state, federal, and industry-specific security regulations and requirements.
• Represent IT Solutions by participating in working groups, project teams, and university committees.
• Perform other duties as requested.

Required Qualifications

• Bachelor’s degree required.
• Five years of relevant experience in information and/or cyber security.
• Knowledge of MITRE ATT&CK and SHIELD frameworks.
• Knowledge of an information security framework such as ISO27001, NIST 800-53, or NIST 800-171.
• CompTIA Security+ and/or additional certifications including SSCP, CISSP, or CISA.
• Professional project management and/or IT certifications such as PMP, ITIL, Six Sigma, or agile (as applicable).
• Experience creating enterprise security documentation.
• Experience delivering employee security awareness training.
• Experience in a higher education setting.
• Experience implementing security controls in accordance with Texas Administrative Code (TAC 202).
• Ability to maintain security and integrity of the infrastructure.
• Understanding of information security theories, principles, practices, methods, and techniques.
• Ability to apply cybersecurity and privacy principles to organizational requirements, including confidentiality, integrity, availability, authentication, and non-repudiation.
• Ability to develop and maintain project plans and manage small to medium sized projects impacting information security.
• Ability to collect and use data such as indicators of compromise from cyber defense resources.
• Ability to recognize and categorize vulnerabilities and associated attacks.
• Skill in writing and reviewing information security policies and procedures.
• Knowledge of information technology auditing processes and remediations.
• Strong written and oral communication skills, including presenting ideas in user-friendly, business-friendly, and technical language.
• Proven analytical and problem-solving abilities, including anticipating, identifying, and solving critical issues.
• Ability to build relationships and collaborate with constituents across a diverse and distributed environment.
• Knowledge of Texas Administrative Code (TAC 202) requirements.
• Ability to use a personal computer and other office equipment, including related university software and email.

Preferred Technologies and Frameworks

MITRE ATT&CK, SHIELD, ISO27001, NIST 800-53, NIST 800-171, CompTIA Security+, SSCP, CISSP, CISA, PCI, HIPAA, TAC 202, PMP, ITIL, Six Sigma, agile.

Organizational Relationships

• Reports to: Associate Director, Information Security
• Supervises: No supervisory responsibilities

Attendance, Work Guidance, and University Security Responsibilities

• Regular and reliable attendance during scheduled days and work hours is essential.
• Work is performed under general supervision; performance is based on completion of assignments and results.
• Performance evaluation is conducted through the university’s performance evaluation system in accordance with university policies and procedures.
• All employees share responsibility for maintaining information security and privacy requirements by following federal and state regulations and TWU policies and procedures.

Work Schedule, Travel, and Environment

• Travel may be required.
• May be required to work evenings, weekends, and holidays.
• Work is normally performed in a typical interior work environment.

Safety and Incident Reporting

• Employees are responsible for completing assigned tasks safely and efficiently.
• Employees must report unsafe work conditions or practices and near-miss incidents to their supervisor and Risk Management.
• Injury or accident reports must be submitted to the Office of Human Resources and Risk Management within 24 hours.

Role Details

• Location: Denton, TX (onsite)
• Minimum Experience: 5 years