The Lead Security Analyst - Research Computing is responsible for the operational delivery, governance, risk management, compliance, and assurance of cybersecurity services within the Office of Innovative Technologies' Research Computing environments. The role combines leadership, security operations, stakeholder management, and regulatory alignment. This role will work closely with OIT Security Operations, GRC, Office of Research Innovation & Economic Development (ORIED), researchers, faculty, auditors, and external stakeholders.
The role plans, builds, and implements appropriate security controls to protect against internal and external threats to OIT's research computing environments' information and assets. The role develops and maintains processes and procedures associated with security monitoring and uses cases to respond to potential security incidents and potential threats or attempts to compromise security controls. The role provides performance management and professional development for all members of the Research Computing Security team.
Lead Research Computing Security Operations and Program Delivery
Provide leadership for the Research Computing Security team, including planning, direction, activity prioritization, performance management, and professional development.
Lead projects to design, implement, and mature security controls across research computing environments.
Mentor team members on regulatory awareness, evidence quality, customer-facing security operations, and research security best practices.
Drive Research Security Governance, Compliance, and Risk Management
Serve as a subject matter expert and trusted advisor to researchers, principal investigators, research computing staff, compliance partners, and central IT on research security matters.
Oversee compliance activities for sponsor, contractual, and regulatory frameworks such as NIST 800-171, NIST 800-53, CMMC, HIPAA, FERPA, and export control requirements .
Prepare and maintain artifacts for assessments, audits, attestations, and ongoing compliance reviews.
Stay current on emerging regulatory requirements and help evolve the research security program to meet changing expectations.
Direct and coordinate risk assessments, gap analyses, and periodic control reviews for research computing platforms, projects, and data environments.
Document findings, rate risk, recommend mitigation strategies, and support continuous monitoring and risk acceptance workflows.
Review contracts and agreements and provide guidance on export controls, sanctions, and research security compliance obligations.
Communicate requirements, assist with training and awareness, issue escalation, and reporting for research environments.
Strengthen Security Controls, Documentation, and Monitoring
Coordinate and validate the implementation of administrative, technical, and physical security controls for research computing environments handling controlled, restricted, or sensitive data.
Track remediation activities, exceptions, inherited controls, and supporting evidence with system owners and technical teams.
Maintain audit-ready security documentation, including system security plans, control narratives, procedures, implementation statements, inventories, diagrams, and plans of action and milestones.
Monitor, triage, and investigate security alerts affecting research computing systems and services.
Lead Incident Response Support and Readiness
Oversee escalation handling for security events affecting regulated research customers, ensuring timely, accurate, and compliant communications.
Serve as the subject matter expert for cybersecurity incident response activities within research computing environments.
Support cyber security incident response activities for other university departments, units, and colleges as needed.
Assist in the development of and participation in tabletop exercises and penetration testing activities.
Required Qualifications
Education : Bachelor’s degree in Computer Science, Information Technology Management, IT Security, or a related field.
Experience: Seven (7) years of relevant experience providing information security services for an organization of similar function and size.
Knowledge, Skills, and Abilities:
Extensive knowledge of cybersecurity governance, control frameworks, and risk assessment methodologies relevant to research environments.
Extensive knowledge of NIST 800-171, NIST 800-53, CMMC, HIPAA, FERPA , and common regulatory or sponsor requirements affecting research computing.
Skill in developing and maintaining control documentation, evidence repositories, diagrams, and audit-ready compliance artifacts.
Skill in analyzing technical and procedural controls, identifying gaps, and documenting practical risk mitigation plans.
Strong communication skills with the ability to clearly explain security requirements to researchers, technical staff, and non-technical stakeholders while managing multiple compliance efforts simultaneously.
Demonstrated ability to lead work, coordinate priorities, and contribute to security operations in complex, highly collaborative environments.
Applicants must be legally authorized to work in the United States on a full-time basis without need now or in the future for sponsorship for employment-based visa status.
Preferred Qualifications
Work Location
Compensation and Benefits
Application Instructions
To express interest, please submit an application with the noted below attachments:
About The Division
OIT is a centralized IT organization, which means many of the core technology services the university relies on are coordinated, supported, and managed through one central unit. Rather than each department building its own separate support structure, OIT helps unify technology operations so that students, faculty, and staff across the university have a consistent, reliable experience.
