[Hiring] Information Security Analyst @Harvard University

Role Description

Harvard Medical School nurtures a diverse group of leaders and future leaders in both clinical care and biomedical inquiry who are on the front lines of medicine and science serving individuals and populations locally, nationally, and globally. The Information Technology Department at Harvard Medical School enables this mission by delivering secure and scalable services. Digital Identity is a key underpinning of the digital transformation strategy driving trust and seamless experiences for our incredibly talented community.

The Security team in the Harvard Medical School Department of Information Technology is seeking an Information Security Analyst to help build and sustain Vulnerability, Cloud and DLP Management solutions and to provide critical operational support for HMS infrastructure. This position offers a breadth of opportunity, ranging from traditional on-prem systems and solutions to contemporary cloud solutions. The Information Security Analyst will work collaboratively with all departments within HMS IT and Harvard University IT.

Principal Duties and Responsibilities:

• Operate recurring vulnerability and compliance reporting, quality-check results, and distribute reports to HMS groups on schedule.
• Advise system administrators on findings and remediation, and track issues through to verified closure.
• Run day-to-day execution of the endpoint security compliance effort, ensuring required security agents are deployed and healthy.
• Monitor cloud security posture, triage misconfigurations, and work with cloud owners to remediate findings.
• Support vendor risk management, including security reviews and follow-up on identified issues.
• Triage data loss prevention alerts and coordinate remediation of sensitive data on shared storage.
• Support security assessments, penetration testing, and the security awareness program.
• Build dashboards and reports, and use basic scripting to automate recurring tasks.

Qualifications

• Minimum of five years’ experience post-secondary education or relevant work experience.
• Bachelor's degree in information systems, cybersecurity, or a related field.
• Working knowledge of vulnerability management fundamentals, including CVE and CVSS, risk prioritization, and remediation timelines.
• Demonstrated ability to obtain results from technical staff who do not report to you, with strong written and verbal communication skills.
• Hands-on experience with enterprise vulnerability scanning, endpoint protection, or asset inventory tools.
• Experience with cloud security posture management and common cloud misconfigurations.
• Experience with vendor or third-party security risk assessments.
• Experience with data loss prevention alert triage and sensitive data remediation.
• Experience with endpoint management and agent deployment at scale.
• Experience with IT service management or GRC ticketing and reporting.
• Familiarity with HIPAA, NIST SP 800-53, the NIST Cybersecurity Framework, or comparable frameworks.
• Experience in higher education, an academic medical center, or a research environment, especially with decentralized IT groups.
• Strong problem-solving skills, attention to detail, and the ability to act as a trusted advisor.

Requirements

• Certificates and Licenses:
• SecAI+
• Security+
• PenTest+
• CCSK
• Cloud+

Benefits

• Generous paid time off including parental leave
• Medical, dental, and vision health insurance coverage starting on day one
• Retirement plans with university contributions
• Wellbeing and mental health resources
• Support for families and caregivers
• Professional development opportunities including tuition assistance and reimbursement
• Commuter benefits, discounts and campus perks