IT Security Analyst
Certain terms and conditions of employment for this position, including the rate of pay, benefits, etc., are currently subject to negotiation with the appropriate union.
The Cybersecurity Awareness Analyst leads the design and execution of the organization’s security awareness and training programs in support of its healthcare and research mission. This role develops and delivers programs that ensure faculty, staff, students, and affiliated personnel “know, understand, and follow [security] requirements” in order to reduce institutional risk. The Analyst works closely with the Cybersecurity Risk Management Manager and CISO to support broader security initiatives, policy development, and compliance (e.g. HIPAA, FERPA, institutional data protection). The position balances communications, training, and technical expertise to foster a culture of security across research, academic, healthcare, and IT communities.
This experienced IT security professional applies specialized expertise in security awareness, governance, and training. The Analyst designs and recommends methods and strategies to achieve security awareness goals, leveraging advanced knowledge of cybersecurity principles, regulatory requirements, and learning best practices. The individual works independently to develop creative, long-term awareness solutions and provides technical and strategic support on security policy implementation throughout the institution.
Department Overview
UCSF Cybersecurity protects and responds to both internal and external threats. It monitors for vulnerabilities, risks, and exposures and mitigates issues prior to exploitation. If an incident does occur, IT Security investigates, determines impact, and recommends controls for reduced recurrence likelihood.
- Vulnerability Management
- Network Security
- Application Security
- E-Discovery service
- Incident response and forensic analysis
- Threat hunting and event analysis
- Establishing policies and standards for information security
- Providing guidance and conducting risk assessments of systems and solutions
- Governance, risk, and compliance
- Architecting secure business solutions
- Architecting threat detection, security monitoring and forensic solutions
- Outreach and security awareness training and education
- Endpoint security, such as encryption, anti-malware, endpoint detection and response
% of time | Essential Function (Yes/No) |
Key Responsibilities (To be completed by Supervisor) |
|
|
|
35 | Develop, manage, and operate security awareness programs. Plan, organize, and deliver comprehensive cybersecurity training and awareness activities (e.g. phishing simulations, workshops, e-learning) targeting students, faculty, healthcare providers, and staff. Create engaging content (e.g. videos, newsletters, campaigns) and ensure training effectively changes user behavior to reduce human risk | |
15 | Governance and policy support. Assist in developing and updating cybersecurity policies, standards and guidelines. Ensure awareness initiatives align with regulatory requirements (HIPAA, FERPA, etc.) and enterprise security policies. Help coordinate policy communication so that all community members understand and follow requirements | |
10 | Regulatory and technical training. Provide specialized training on relevant regulations (e.g. HIPAA, data privacy laws, research compliance) and IT security concepts (e.g. secure data handling, mobile device security) to varied audiences. Work with curriculum and compliance teams to incorporate cybersecurity topics into mandatory training for healthcare workers and research staff. | |
10 | Communications and outreach. Create clear, accessible communications (email bulletins, web content, posters) to reinforce security best practices. Represent the department at campus events (e.g. Cybersecurity Awareness Month, training fairs), and engage campus and affiliate communities in security culture. Tailor messages to diverse groups (students, researchers, clinicians) based on their needs | |
10 | Project management support. Assist the Manager and CISO on departmental projects. Provide project planning, scheduling, and progress reporting for initiatives like compliance audits, risk assessments, and security campaigns. Coordinate with IT and operational teams to ensure timely project execution and follow-up. | |
5 | Collaboration with UC and external partners. Participate in UC systemwide security working groups, sharing best practices and policies. Maintain relationships with security training vendors and professional networks. Leverage these resources to enhance the awareness program and stay current on effective training techniques. | |
5 | Other related duties as assigned. Performs additional tasks consistent with departmental needs and bargaining-unit guidelines. | |
10 | Cybersecurity Research Security support. Provides miscellaneous Cybersecurity Research Security team support activities as assigned, including coordination of research security communications, meeting support, tracking action items – MCA, POAM, documentation updates, training records, compliance evidence collection, stakeholder follow-up, and other audit/assessment related program support duties consistent with the IT Security Analyst classification and departmental needs. | |
0% | (To update total %, enter the amount of time in whole numbers (without the % symbol - e.g., 15, 20) then highlight the total sum (e.g., 1%) at the bottom of the column and press F9. The total sum should add up to 100%.) |
REQUIRED QUALIFICATIONS
Bachelor’s degree in Computer Science, Information Security, Education, Communications, or a related field (or equivalent experience).
- Minimum related experience, 5+ years
- Communication: Able to translate complex security concepts into clear, concise messages for diverse audiences (students, faculty, clinicians, IT staff)
- Security Expertise: Broad knowledge of information security principles, risk management and threat landscape. Familiarity with NIST or similar frameworks. Understanding of healthcare and research privacy requirements (HIPAA, FERPA) and how to incorporate them into training
- Project Management: Strong organizational and planning skills. Experience managing projects from conception through implementation, including scheduling, resource coordination, and reporting
Collaboration: Proven ability to work cross-functionally with IT, legal/compliance, clinical, and academic stakeholders. Skilled at coordinating people and tasks across departments to achieve security goals.
REQUIRED CERTIFICATIONS
Relevant professional certifications preferred (e.g. CISSP, CISM, Security+). Certification or coursework in security awareness, instructional design, or project management is desirable.
PREFERRED QUALIFICATIONS
Training & Education: Proficiency with training design and delivery (e.g. adult learning, e-learning platforms, phishing simulation tools). Ability to evaluate training effectiveness and metrics (completion rates, assessment results).
- Analytical Skills: Problem-solving mindset and attention to detail. Able to assess program outcomes, identify areas for improvement, and adapt strategies accordingly. Basic understanding of information risk concepts is required