IT Risk & Information Security Analyst

Princeton University; Princeton (NJ); On-site; USD 105,000 - 120,000; Full time

Job summary

Princeton University seeks an IT Risk & Information Security Analyst to strengthen security, privacy, resilience, and continuity across campus services. You will lead IT risk management, information security, data privacy, disaster recovery, incident response, and security awareness, collaborating with USIT, ISO, OIT, and departments.

The role requires translating risk findings into actionable improvements, strong communication, and the ability to bridge policy with technical controls.

Qualifications

• 5+ years of professional IT risk management or information security experience.
• Experience with security incident response and management.
• Knowledge of data classification, data privacy, and handling of regulated data.
• Familiarity with FERPA, GDPR, PCI, or equivalent standards is preferred.
• Proficiency with security testing methods and tooling.

Responsibilities

• Lead IT risk and information security initiatives across University Services.
• Coordinate vulnerability management, incident response, and disaster recovery activities.
• Partner with multiple teams to classify data and ensure secure operations.
• Develop metrics, reports, and training to improve security awareness.
• Support regulatory compliance and security policy alignment.

Skills

IT risk management

Information security

Incident response

Regulatory compliance

Data privacy

Security testing tools

Cross-functional collaboration

Communication skills

Disaster recovery planning

Risk assessment

Education

Bachelor's degree in Information Technology, Cybersecurity, or related field

Job description

Overview

University Services at Princeton University is seeking an IT Risk & Information Security Analyst to help strengthen the security, privacy, resilience, and continuity of the systems and data that support a broad portfolio of campus services. This role leads and coordinates IT risk management, information security, data privacy, mission continuity, disaster recovery, incident response, and security awareness efforts across University Services. Reporting to the Senior Director of Information Technology for University Services, with a dotted line to the University Chief Information Security Officer, the analyst will work closely with University Services Information Technology (USIT); the Office of Information Technology (OIT), including the Information Security Office (ISO); departmental leaders; and operational partners to reduce risk and protect critical services.

The analyst will serve the IT risk and information security needs of the University Services Office of the Vice President, University Services Administration, and the seven operating departments within University Services. This is a highly collaborative role for someone who can bridge policy, risk, technical controls, operational realities, and user education. The successful candidate will bring sound judgment, practical security and privacy knowledge, strong communication skills, and the ability to turn risk findings into clear, actionable improvements.

A cover letter is required for full consideration. A full job description will be furnished prior to interview.

Responsibilities

• Lead system and data security initiatives, including security architecture reviews, access audits, vulnerability management, remediation tracking and coordination, evidence collection, monitoring, reporting, and continuous risk reduction efforts to protect University Services systems and data and support compliance with university security standards and policies.
• Support compliance with applicable regulations, standards, and University policies, including FERPA, GDPR, CCPA, PCI, and privacy-aware handling of sensitive and regulated data.
• Conduct IT risk assessments, privacy reviews, and business impact analyses to identify threats, evaluate operational impacts, prioritize mitigation, and strengthen resilience.
• Partner with USIT, ISO, OIT, and departmental teams on data classification, responsible data handling, retention, access management, endpoint protection, and secure system operations.
• Perform or coordinate system and application security testing, vulnerability scanning, remediation follow-up, and related reporting using appropriate tools, dashboards, and automation.
• Develop, maintain, and test mission continuity and disaster recovery plans for critical University Services functions, systems, applications, and data.
• Serve as the primary University Services point of contact for security incidents, coordinating response, escalation, remediation, communication, post-incident review, and improvement activities.
• Design and deliver security and data privacy awareness training for staff, translating policies, threats, and best practices into practical guidance for diverse audiences.
• Prepare concise reports, metrics, briefings, and recommendations that help leaders understand risk, track progress, and make informed decisions.
• Works on special projects as assigned.

Qualifications

ESSENTIAL QUALIFICATIONS

• 5+ years of relevant professional, hands-on experience in an IT risk management and/or information security role.
• Experience with security incident response and management.
• Familiarity with regulatory requirements and compliance standards.
• Knowledge of data classification and management practices.
• Knowledge of data privacy principles, privacy-aware data handling practices, and requirements related to sensitive and regulated data.
• Proficiency in security testing tools and methodologies (e.g. vulnerability scanning, penetration testing, static and/or dynamic code analysis, etc.).
• Experience using tools, automation technologies, dashboards, reporting platforms, or workflow systems to improve security operations, risk tracking, audit readiness, and remediation tracking, coordination, and follow-through.
• Strong knowledge of security and privacy frameworks and best practices.
• Ability to work collaboratively with cross-functional teams.
• Strong communication and interpersonal skills.
• Ability to foster and maintain positive and professional working relationships; ability to effectively handle interpersonal interactions at all levels and respond appropriately to conflicts and problems.
• Ability to work with complex confidential information and/or issues using discretion and judgement.
• Excellent written/oral communication skills in order to present findings to all levels of management.
• Possess organizational skills to handle several projects simultaneously, accommodate shifting priorities, and meet deadlines.
• Ability and drive to stay current with and report on the rapidly evolving risk and information security landscape.
• Education: Bachelor's degree in Information Technology, Cybersecurity, or a related field

PREFERRED QUALIFICATIONS

• Relevant and active certifications such as CISSP, CISM, CISA, or Security+.
• Professional experience in a higher education environment.
• Experience with the Family Educational Rights and Privacy Act (FERPA)
• Experience with the Payment Card Industry Data Security Standards (PCI DSS)
• Experience with privacy, data governance, data classification, or responsible data use initiatives in a complex organization.
• Experience developing scripts, integrations, reports, or automated workflows that reduce manual effort and improve risk, security, compliance, or privacy processes.
• Experience training, developing, and improving others’ understanding of risk and information security.

________________________________

Princeton University is an Equal Opportunity Employer and all qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity or expression, national origin, disability status, protected veteran status, or any other characteristic protected by law.

The University considers factors such as (but not limited to) scope and responsibilities of the position, candidate's qualifications, work experience, education/training, key skills, market, collective bargaining agreements as applicable, and organizational considerations when extending an offer. The posted salary range represents the University's good faith and reasonable estimate for a full-time position; salaries for part-time positions are pro-rated accordingly.

If the salary range on the posted position shows an hourly rate, this is the baseline; the actual hourly rate may be higher, depending on the position and factors listed above.

The University also offers a comprehensive benefit program to eligible employees. Please see this link for more information.

Standard Weekly Hours

36.25

Eligible for Overtime

No

Benefits Eligible

Yes

Probationary Period

180 days

Essential Services Personnel (see policy for detail)

No

Physical Capacity Exam Required

No

Valid Driver’s License Required

No

Experience Level

Mid-Senior Level#LI-JJ1

Salary Range

$105,000 to $120,000