Information Security Analyst

About the role

Harvard Medical School nurtures a diverse group of leaders and future leaders in both clinical care and biomedical inquiry who are on the front lines of medicine and science serving individuals and populations locally, nationally, and globally. The Information Technology Department at Harvard Medical School enables this mission by delivering secure and scalable services. Digital Identity is a key underpinning of the digital transformation strategy driving trust and seamless experiences for our incredibly talented community.

The Security team in the Harvard Medical School Department of Information Technology is seeking an Information Security Analyst to help build and sustain Vulnerability, Cloud and DLP Management solutions and to provide critical operational support for HMS infrastructure. This position offers a breadth of opportunity, ranging from traditional on-prem systems and solutions to contemporary cloud solutions. The Information Security Analyst will work collaboratively with all departments within HMS IT and Harvard University IT.

Principal Duties and Responsibilities

• Operate recurring vulnerability and compliance reporting, quality-check results, and distribute reports to HMS groups on schedule.
• Advise system administrators on findings and remediation, and track issues through to verified closure.
• Run day-to-day execution of the endpoint security compliance effort, ensuring required security agents are deployed and healthy.
• Monitor cloud security posture, triage misconfigurations, and work with cloud owners to remediate findings.
• Support vendor risk management, including security reviews and follow-up on identified issues.
• Triage data loss prevention alerts and coordinate remediation of sensitive data on shared storage.
• Support security assessments, penetration testing, and the security awareness program.
• Build dashboards and reports, and use basic scripting to automate recurring tasks.

Basic Qualifications

• Minimum of five years' experience post-secondary education or relevant work experience.

Additional Qualifications and Skills

• Bachelor's degree in information systems, cybersecurity, or a related field.
• Working knowledge of vulnerability management fundamentals, including CVE and CVSS, risk prioritization, and remediation timelines.
• Demonstrated ability to obtain results from technical staff who do not report to you, with strong written and verbal communication skills.
• Hands-on experience with enterprise vulnerability scanning, endpoint protection, or asset inventory tools.
• Experience with cloud security posture management and common cloud misconfigurations.
• Experience with vendor or third-party security risk assessments.
• Experience with data loss prevention alert triage and sensitive data remediation.
• Experience with endpoint management and agent deployment at scale.
• Experience with IT service management or GRC ticketing and reporting.
• Familiarity with HIPAA, NIST SP 800-53, the NIST Cybersecurity Framework, or comparable frameworks.
• Experience in higher education, an academic medical center, or a research environment, especially with decentralized IT groups.
• Strong problem-solving skills, attention to detail, and the ability to act as a trusted advisor.

Certificates and Licenses

• SecAI+
• Security+
• PenTest+
• CCSK
• Cloud+

Additional Information

• Standard Hours/Schedule: 35 hours per week.
• Visa Sponsorship Information: Harvard University is unable to provide visa sponsorship for this position.
• Pre-Employment Screening: Identity, Criminal.
• Interview Format: All interviews will be conducted remotely using a video conferencing platform.
• Staying Informed About Your Application: Due to the high volume of applications, we may not always be able to reach out right away, but you can track your status anytime through the Careers@Harvard portal.

#LI-DK1

Work Format Details

This position has been determined by school or unit leaders that the duties and responsibilities can effectively be performed fully remotely at a non-Harvard location. Employees in fully remote positions must work all scheduled hours in a Harvard registered state in compliance with the University's Policy on Employment Outside of Massachusetts. At the discretion of the department, fully remote employees may occasionally be required on site at a Harvard location. Certain visa types and funding sources may limit work location. Individuals must meet work location sponsorship requirements prior to employment.

Salary Grade and Ranges

This position is salary grade level 058. Please visit Harvard's Salary Ranges to view the corresponding salary range and related information.

Benefits

• Harvard offers a comprehensive benefits package that is designed to support a healthy work-life balance and your physical, mental and financial wellbeing.
• Because here, you are what matters.
• Our benefits include, but are not limited to:

• Generous paid time off including parental leave
• Medical, dental, and vision health insurance coverage starting on day one
• Retirement plans with university contributions
• Wellbeing and mental health resources
• Support for families and caregivers
• Professional development opportunities including tuition assistance and reimbursement
• Commuter benefits, discounts and campus perks