Overview

University Services at Princeton University is seeking an IT Risk & Information Security Analyst to help strengthen the security, privacy, resilience, and continuity of the systems and data that support a broad portfolio of campus services. This role leads and coordinates IT risk management, information security, data privacy, mission continuity, disaster recovery, incident response, and security awareness efforts across University Services. Reporting to the Senior Director of Information Technology for University Services, with a dotted line to the University Chief Information Security Officer, the analyst will work closely with University Services Information Technology (USIT); the Office of Information Technology (OIT), including the Information Security Office (ISO); departmental leaders; and operational partners to reduce risk and protect critical services.

The analyst will serve the IT risk and information security needs of the University Services Office of the Vice President, University Services Administration, and the seven operating departments within University Services. This is a highly collaborative role for someone who can bridge policy, risk, technical controls, operational realities, and user education. The successful candidate will bring sound judgment, practical security and privacy knowledge, strong communication skills, and the ability to turn risk findings into clear, actionable improvements.

A cover letter is required for full consideration. A full job description will be furnished prior to interview.

This position is a hybrid role.

Responsibilities

• Lead system and data security initiatives, including security architecture reviews, access audits, vulnerability management, remediation tracking and coordination, evidence collection, monitoring, reporting, and continuous risk reduction efforts to protect University Services systems and data and support compliance with university security standards and policies.
• Support compliance with applicable regulations, standards, and University policies, including FERPA, GDPR, CCPA, PCI, and privacy-aware handling of sensitive and regulated data.
• Conduct IT risk assessments, privacy reviews, and business impact analyses to identify threats, evaluate operational impacts, prioritize mitigation, and strengthen resilience.
• Partner with USIT, ISO, OIT, and departmental teams on data classification, responsible data handling, retention, access management, endpoint protection, and secure system operations.
• Perform or coordinate system and application security testing, vulnerability scanning, remediation follow-up, and related reporting using appropriate tools, dashboards, and automation.
• Develop, maintain, and test mission continuity and disaster recovery plans for critical University Services functions, systems, applications, and data.
• Serve as the primary University Services point of contact for security incidents, coordinating response, escalation, remediation, communication, post-incident review, and improvement activities.
• Design and deliver security and data privacy awareness training for staff, translating policies, threats, and best practices into practical guidance for diverse audiences.
• Prepare concise reports, metrics, briefings, and recommendations that help leaders understand risk, track progress, and make informed decisions.
• Works on special projects as assigned.

Qualifications

ESSENTIAL QUALIFICATIONS
• 5+ years of relevant professional, hands-on experience in an IT risk management and/or information security role.
• Experience with security incident response and management.
• Familiarity with regulatory requirements and compliance standards.
• Knowledge of data classification and management practices.
• Knowledge of data privacy principles, privacy-aware data handling practices, and requirements related to sensitive and regulated data.
• Proficiency in security testing tools and methodologies (e.g. vulnerability scanning, penetration testing, static and/or dynamic code analysis, etc.).
• Experience using tools, automation technologies, dashboards, reporting platforms, or workflow systems to improve security operations, risk tracking, audit readiness, and remediation tracking, coordination, and follow-through.
• Strong knowledge of security and privacy frameworks and best practices.
• Ability to work collaboratively with cross-functional teams.
• Strong communication and interpersonal skills.
• Ability to foster and maintain positive and professional working relationships; ability to effectively handle interpersonal interactions at all levels and respond appropriately to conflicts and problems.
• Ability to work with complex confidential information and/or issues using discretion and judgement.
• Excellent written/oral communication skills in order to present findings to all levels of management.
• Possess organizational skills to handle several projects simultaneously, accommodate shifting priorities, and meet deadlines.
• Ability and drive to stay current with and report on the rapidly evolving risk and information security landscape.

• Education: Bachelor's degree in Information Technology, Cybersecurity, or a related field

PREFERRED QUALIFICATIONS
• Relevant and active certifications such as CISSP, CISM, CISA, or Security+.
• Professional experience in a higher education environment.
• Experience with the Family Educational Rights and Privacy Act (FERPA)
• Experience with the Payment Card Industry Data Security Standards (PCI DSS)
• Experience with privacy, data governance, data classification, or responsible data use initiatives in a complex organization.
• Experience developing scripts, integrations, reports, or automated workflows that reduce manual effort and improve risk, security, compliance, or privacy processes.
• Experience training, developing, and improving others’ understanding of risk and information security.

________________________________

Princeton University is an Equal Opportunity Employer and all qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity or expression, national origin, disability status, protected veteran status, or any other characteristic protected by law.

The University considers factors such as (but not limited to) scope and responsibilities of the position, candidate's qualifications, work experience, education/training, key skills, market, collective bargaining agreements as applicable, and organizational considerations when extending an offer. The posted salary range represents the University's good faith and reasonable estimate for a full-time position; salaries for part-time positions are pro-rated accordingly.

If the salary range on the posted position shows an hourly rate, this is the baseline; the actual hourly rate may be higher, depending on the position and factors listed above.

The University also offers a comprehensive benefit program to eligible employees. Please see this link for more information.