Information Security Analyst

This is a fully remote position, open to applicants in Massachusetts.

📋 Description

• Manage periodic vulnerability and compliance reporting, ensuring the accuracy of results, and timely distribution of reports to HMS groups.

• Provide guidance to system administrators regarding findings and remediation, while tracking issues until they are resolved.

• Oversee the daily implementation of the endpoint security compliance initiative, confirming that necessary security agents are effectively deployed and functioning.

• Monitor the cloud security posture, assess misconfigurations, and collaborate with cloud owners to rectify identified issues.

• Assist in vendor risk management, conducting security reviews and following up on any identified concerns.

• Evaluate data loss prevention alerts and coordinate the remediation of sensitive data stored on shared resources.

• Support security evaluations, penetration testing, and the security awareness initiative.

• Create dashboards and reports, and utilize basic scripting to automate repetitive tasks.

• Collaborate effectively with all departments within HMS IT and Harvard University IT.

• Deliver essential operational support for the infrastructure of Harvard Medical School.

⛳️ Requirements

• A minimum of five years of experience in post-secondary education or equivalent professional experience.

• A Bachelor's degree in information systems, cybersecurity, or a related discipline.

• Proficient understanding of vulnerability management principles, including CVE and CVSS, risk prioritization, and remediation timelines.

• Proven ability to achieve results from technical personnel who do not report directly to you.

• Excellent written and verbal communication abilities.

• Practical experience with enterprise vulnerability scanning, endpoint protection, or asset inventory tools.

• Familiarity with cloud security posture management and common cloud configuration issues.

• Experience in conducting vendor or third-party security risk assessments.

• Competence in triaging data loss prevention alerts and remediating sensitive data.

• Background in endpoint management and large-scale agent deployment.

• Experience with IT service management or GRC ticketing and reporting systems.

• Knowledge of HIPAA, NIST SP 800-53, the NIST Cybersecurity Framework, or similar frameworks.

• Experience within higher education, an academic medical center, or a research setting, particularly with decentralized IT groups.

• Strong problem-solving capabilities and meticulous attention to detail.

• Ability to serve as a trusted advisor.

• Relevant certifications include SecAI+, Security+, PenTest+, CCSK, Cloud+.

🏝️ Benefits

• Generous paid time off, including parental leave.

• Comprehensive medical, dental, and vision health insurance coverage starting on the first day of employment.

• Retirement plans with contributions from the university.

• Access to wellbeing and mental health resources.

• Support for families and caregivers.

• Opportunities for professional development, including tuition assistance and reimbursement programs.

• Commuter benefits, discounts, and campus perks.