Information Security Analyst

The Risk Management and Compliance (RMC) team within the Office of Cybersecurity is looking for an experienced risk analyst to address the internal security review requests from UW-Madison campus partners. This could include new tools, services, platforms or departmental risk reviews to ensure the security of UW-Madison data at all levels - Public to Restricted (ePHI).

This position will work collaboratively with our campus partners, UW-Madison service providers, and third-party vendors to assess risk and present these risks to campus stakeholders. Responsibilities include evaluating current system use and data classification as entered by the system owner, collaboration with the Office of Compliance on privacy risks and presentation of overall risk with opportunities to improve security prior to utilization. Information gathered to establish the data flow and scope of these requests will be entered by campus partners in an enterprise risk review tool (OneTrust). This position is not responsible for incident response, vulnerability review, or minimizing the attack surface of the university.

A successful individual will have information security expertise as well as project management, business analysis, solution implementation skills, the ability to communicate to technical, non-technical staff and university leadership. This position reports to the Office of Cybersecurity and serves as a campus technical expert and authority on information security risk analysis and compliance matters. As a trusted advisor and partner with UW-Madison campus partners, UW System integration teams, project managers and system owners, this position will focus on the most efficient and impactful way to review risk of existing tools and present opportunities for improving overall security.

This position will also have specific responsibility to assist in the establishment and maintenance of an RMC project management tool to improve overall efficiency. Acquiring feedback from campus partners and liaisons is also required to make procedural adjustments to the service this team offers.

The candidate selected for this position may perform a combination of on-site and remote work subject to an approved flexible work arrangement (FWA), which is reviewed and approved annually. Remote work requires successful candidates to possess their own high-speed internet and phone to perform the work on a university provided computer. Per University policy, transportation between home and assigned work location is not payable/reimbursable and will be at the expense of the employee. This position will primarily work remotely but may occasionally need to come to campus for scheduled meetings, retreats, or workshops.

The Division of Information Technology (DoIT) is an exciting and dynamic work environment grounded in organizational principles that include family and personal life/work balance; an inclusive, respectful, and supportive work environment; professional development opportunities; innovation; and alignment with the campus's teaching, learning, and research missions. DoIT provides core IT infrastructure services to the university, develops and implements services for the university and in some cases, for the Universities of Wisconsin, plays a major role in managing the state-wide higher education network and regional networks.

• Assists in the design, development, and implementation of security methodology and infrastructure for major systems

• Conducts vulnerability-scanning analysis, tests security controls, documents the results of risk assessments, and designs procedures to prevent future incidents

• Assist in development and documentation of an RMC project management tool to include processes and workflows

• Liaison with campus IT practitioners to gather needs and feedback for RMC to ensure efficiency

• Configures, develops, and tests applications and security controls

Division of Information Technology, Office of Cybersecurity, Risk Management & Compliance (RMC)

The Office of Cybersecurity leads and manages university efforts to reduce risk through data protection, continuous diagnostics, cybersecurity awareness training, and effective processes and procedures to safeguard intellectual property and sensitive information. The office has four teams: Risk Management and Compliance, Cybersecurity Operations, Business Systems Security and Cybersecurity Programs, and IT Policies.

The Risk Management & Compliance (RMC) team has established a formalized risk assessment program for campus. This program offers review and validation on technical, administrative, and physical controls that affect the security of a vendor or service handling UW-Madison data. RMC assessments are designed to communicate levels of risk and provide recommendations for risk reduction.

Starting salary will be based on experience and qualifications. Well qualified applicants can anticipate to earn between $99,000 - $117,000, with final salary based on experience and qualifications.

Employees in this position can expect to receive benefits such as generous vacation, holidays, and sick leave; competitive insurances and savings accounts; retirement benefits. Benefits information can be found at (https://hr.wisc.edu/benefits/).

• Established professional experience conducting risk assessments against recognized standards (NIST, COBIT or ISO) with minimal oversight.

• Established professional experience working with security requirements within a healthcare, higher ed, or research organization.

• Working knowledge of NIST, HIPAA, Artificial Intelligence and cloud computing services.

• Holds a current professional certification in Information Security or IT Audits.

• Experience executing project management skills including setting expectations, communicating to all levels of the organization, and leading a team.

• Experience working independently to conduct technical investigations with diverse constituents, providing detailed written reports and presentations.

• Experience in assessing vendors as part of procurement and implementation stages

• Experience using standard industry applications to create or update current documents to meet compliance reporting requirements (i.e. office productivity software, project management software)

• Expertise using vulnerability management tools to analyze discovered vulnerabilities against current configurations to determine the organizational risk.

• Experience serving as both a lead and a contributing team member on projects

• Knowledge of enterprise project management tools and skills to navigate them (Ie JIRA).

Bachelor's Degree Preferred Minimum

Click on the "Apply" button to start the application process.

You will be prompted to upload the following documents:

-Resume
-Letter of Qualifications

Applicants should attach a letter of qualificationsand resume detailing their training and experience relating to the required and preferred qualifications referencedabove. The application reviewers will be relying on written application materials to determine which qualified applicants willadvance in the recruitment process.

Please note that successful applicants must be authorized to work in the United States without need of employer sponsorship, on or before the effective date of appointment. University sponsorship is not available for this position.

DoIT Human Resources, doit-hr@doit.wisc.edu, 608-263-1790

Relay Access (WTRS): 7-1-1. SeeRELAY_SERVICEfor further information.

Diversity is a source of strength, creativity, and innovation for UW-Madison. We value the contributions of each person and respect the profound ways their identity, culture, background, experience, status, abilities, and opinion enrich the university community. We commit ourselves to the pursuit of excellence in teaching, research, outreach, and diversity as inextricably linked goals.

The University of Wisconsin-Madison fulfills its public mission by creating a welcoming and inclusive community for people from every background - people who as students, faculty, and staff serve Wisconsin and the world.

The University of Wisconsin-Madison is an Equal OpportunityEmployer.

Qualified applicants will receive consideration for employment without regard to, including but not limited to, race, color, religion, sex, sexual orientation, national origin, age, pregnancy, disability, or status as a protected veteran and other bases as defined by federal regulations and UW System policies. We promote excellence by acknowledging skills and expertise from all backgroundsand encourage all qualified individuals to apply. For more information regarding applicant and employee rights and to view federal and state required postings, visit the Human Resources Workplace Poster website.

To request a disability or pregnancy-related accommodationfor any step in the hiring process (e.g., application, interview, pre-employment testing, etc.), please contact the Divisional Disability Representative (DDR)in the division you are applying to.Please make your request as soon as possible to help the university respond most effectively to you.

Employment may require a criminal background check. It may also require your references to answer questions regarding misconduct, including sexual violence and sexual harassment.

The University of Wisconsin System will not reveal the identities of applicants who request confidentiality in writing, except that the identity of the successful candidate will be released. See Wis. Stat. sec. 19.36(7).

The Annual Security and Fire Safety Report contains current campus safety and disciplinary policies, crime statistics for the previous 3 calendar years, and on-campus student housing fire safety policies and fire statistics for the previous 3 calendar years. UW-Madison will provide a paper copy upon request; please contact the University of Wisconsin Police Department.