Info Security Compliance Analyst

Job Description

The Information Security Compliance Analyst is responsible for reviewing, assessing, and fulfilling requirements regarding the various data security standards that apply to Boston College, as well as generally supporting the Boston College community’s information security needs. 

Projects typically involve assessment and review of the framework and the operating environment for common regulatory standards like GLBA, PCI, NIST 800-171, and also specific Data Use Agreements associated with academic research.  These projects may be related to both academic and administrative tasks, and include working closely with the Office of the Vice Provost for Research.  Such projects frequently require working with others to determine requirements and select appropriate solutions.  The Information Security Compliance Analyst will also recommend strategies to prevent security and compliance exposures with guidance from the Director of Computer Policy & Security.

Day-to-day tasks include gathering supporting documentation, data, and reporting associated with the systems and data in regulated environments, coordination of resources, and education of faculty and staff about safe practices within regulated environments.  This includes performing risk assessments, monitoring for common security problems, and maintaining up-to-date knowledge of the forces shaping the compliance environment outside of the University.  The candidate should also have sufficient technical knowledge to be able to map general compliance requirements to specific technologies used to meet them. As part of the Information Security team, the position will also provide ongoing support and advice to IT staff and end users on a variety of security issues, and ensure that Boston College’s security policies and procedures are adhered to.

The expectation is that this position will be filled by someone who is a policy or compliance expert who also possesses broad technical knowledge/background and experience to understand the appropriate technologies and processes needed for the university to meet common compliance standards.

Title and salary commensurate with relevant experience based on the following titles and hiring ranges:

Senior level (5+ yrs of experience): 104k to 130k

Mid level (3+ yrs of experience): 90k to 112k

Requirements

– BA or BS degree in Cybersecurity, Information Technology or related field, or a security certification such as Certified Information Systems Security Professional (CISSP), SANS, or similar.
– Broad technical knowledge in a variety of technical solutions commonly applied to meet compliance requirements.
– Familiarity with security frameworks (NIST CSF, ISO 27001, NIST 800-171, CoBIT, etc.) 
– Strong project management and communication skills.
– Must be able to work both independently and within a team setting.

Preferred/Desired;
– Experience in a higher education or public sector environment.
– Experience with security tools, including SIEM, vulnerability scanners, and endpoint protection.