Lead Security Analyst, Research Computing Office of Innovative Technologies UTK

The Lead Security Analyst - Research Computing is responsible for the operational delivery governance risk management compliance and assurance of cybersecurity services within the Office of Innovative Technologies Research Computing environments. The role combines leadership security operations stakeholder management and regulatory alignment. This role will work closely with OIT Security Operations GRC Office of Research Innovation & Economic Development (ORIED) researchers faculty auditors and external stakeholders.

The role plans builds and implements appropriate security controls to protect against internal and external threats to OITs research computing environments information and assets. The role develops and maintains processes and procedures associated with security monitoring and uses cases to respond to potential security incidents and potential threats or attempts to compromise security controls. The role provides performance management and professional development for all members of the Research Computing Security team.

Lead Research Computing Security Operations and Program Delivery

• Provide leadership for the Research Computing Security team including planning direction activity prioritization performance management and professional development.

• Lead projects to design implement and mature security controls across research computing environments.

• Mentor team members on regulatory awareness evidence quality customer-facing security operations and research security best practices.

Drive Research Security Governance Compliance and Risk Management

• Serve as a subject matter expert and trusted advisor to researchers principal investigators research computing staff compliance partners and central IT on research security matters.

• Oversee compliance activities for sponsor contractual and regulatory frameworks such asNIST 800-171 NIST 800-53 CMMC HIPAA FERPA and export control requirements.

• Prepare and maintain artifacts for assessments audits attestations and ongoing compliance reviews.

• Stay current on emerging regulatory requirements and help evolve the research security program to meet changing expectations.

• Direct and coordinate risk assessments gap analyses and periodic control reviews for research computing platforms projects and data environments.

• Document findings rate risk recommend mitigation strategies and support continuous monitoring and risk acceptance workflows.

• Review contracts and agreements and provide guidance on export controls sanctions and research security compliance obligations.

• Communicate requirements assist with training and awareness issue escalation and reporting for research environments.

Strengthen Security Controls Documentation and Monitoring

• Coordinate and validate the implementation of administrative technical and physical security controls for research computing environments handling controlled restricted or sensitive data.

• Track remediation activities exceptions inherited controls and supporting evidence with system owners and technical teams.

• Maintain audit-ready security documentation including system security plans control narratives procedures implementation statements inventories diagrams and plans of action and milestones.

• Monitor triage and investigate security alerts affecting research computing systems and services.

Lead Incident Response Support and Readiness

• Oversee escalation handling for security events affecting regulated research customers ensuring timely accurate and compliant communications.

• Serve as the subject matter expert for cybersecurity incident response activities within research computing environments.

• Support cyber security incident response activities for other university departments units and colleges as needed.

• Assist in the development of and participation in tabletop exercises and penetration testing activities.

Required Qualifications

• Education: Bachelors degree in Computer Science Information Technology Management IT Security or a related field.

• Experience:Seven (7) years of relevant experienceproviding information security services for an organization of similar function and size.

• Knowledge Skills and Abilities:

  • Extensive knowledge of cybersecurity governance control frameworks and risk assessment methodologies relevant to research environments.

  • Extensive knowledge ofNIST 800-171 NIST 800-53 CMMC HIPAA FERPA and common regulatory or sponsor requirements affecting research computing.

  • Skill in developing and maintaining control documentation evidence repositories diagrams and audit-ready compliance artifacts.

  • Skill in analyzing technical and procedural controls identifying gaps and documenting practical risk mitigation plans.

  • Strong communication skills with the ability to clearly explain security requirements to researchers technical staff and non-technical stakeholders while managing multiple compliance efforts simultaneously.

  • Demonstrated ability to lead work coordinate priorities and contribute to security operations in complex highly collaborative environments.

Applicants must be legally authorized to work in the United States on a full-time basis without need now or in the future for sponsorship for employment-basedvisa status.

Preferred Qualifications

• Experience:

  • Ten (10) or more years of relevant experienceproviding information security services for an organization of similar function and size.

  • At leastthree (3) years of experience in a research computing environment.

  • Experience leading security or compliance efforts in higher education research administration or other regulated environments.

  • Relevant certifications such asSecurityCISSPCISMCISACGRC orCAP

• Knowledge Skills and Abilities:

  • Knowledge of higher education research administration export control and controlled unclassified information requirements.

  • Knowledge of cloud and hybrid research computing architectures data classification and secure enclave design.

  • Experience using governance risk and compliance tools spreadsheets and workflow systems to manage control status and POA&Ms.

  • Ability to interpret contract clauses and translate sponsor or regulatory requirements into operational security controls.

  • Knowledge with NIST 800-223

Work Location

• Location: Knoxville TN

• Hybrid - successful candidate will be required to be onsite as necessary to complete job responsibilities and support incident response activities.

Compensation and Benefits

• UT market range:MR16

• Anticipated hiring range:$100000 $110000

• Find more information on the UT Market Range structurehere

• Find more information on UT Benefitshere

Application Instructions

To express interest please submit an application with the noted below attachments:

• Resume

• Cover Letter

About The Division

OIT is a centralized IT organization which means many of the core technology services the university relies on are coordinated supported and managed through one central unit. Rather than each department building its own separate support structure OIT helps unify technology operations so that students faculty and staff across the university have a consistent reliable experience.