Security Assurance

University of Utah; Salt Lake City (UT); On-site; USD 64,000 - 124,000; Full time

Job summary

The University of Utah seeks a Security Assurance & Compliance Analyst, IV to own the compliance lifecycle for CHPC environments, coordinating governance, evidence, findings, and remediation for regulated research. You will interpret requirements including NIST SP 800-171, CMMC, HIPAA, and sponsor obligations, ensuring assessment-ready status.

Collaborate with technical teams and university partners to document controls, manage evidence, and drive continuous improvement across Linux/Windows

Qualifications

• Bachelor’s degree or equivalency with security/compliance focus.
• Ability to interpret regulatory requirements and document them clearly.
• Experience managing multiple findings and remediation activities.

Responsibilities

• Maintain and reconcile SSPs, POA&Ms, control docs.
• Lead mock audits, security assessments, sponsor reviews.
• Evaluate evidence for sufficiency and traceability.
• Coordinate evidence requests with subject-matter experts.
• Track findings, owners, milestones, and deadlines.
• Draft security policies, standards, and governance docs.
• Research regulatory requirements affecting CHPC environments.
• Maintain GRC workflows in Hyperproof or similar.
• Perform quality reviews for alignment of docs and practices.
• Develop compliance reporting on readiness and remediation progress.
• Coordinate with university security, legal, and contracting teams.

Skills

Independent research

Stakeholder comms

Workflow management

Findings management

Evidence handling

Compliance documentation

Education

Bachelor's degree or equivalency

Tools

GRC platforms

Hyperproof

Job description

Security Assurance & Compliance Analyst, IV

Job Summary

The Security Assurance & Compliance Analyst, IV serves as anadvanced individual contributor within the CHPC Security &Compliance team. This individual owns and will be the primarybuilder of the operational assurance and compliance lifecycle forCHPC environments supporting regulated and sensitive research. Theposition is responsible for compliance documentation, assessmentreadiness, control and evidence management, findings andremediation tracking, GRC workflows, governance documentation, andcontinuous improvement.

The Analyst works with technical teams and University partners toensure applicable requirements are accurately interpreted anddocumented, controls are supported by sufficient and traceableevidence, findings are managed to closure, and environments remainassessment-ready. Applicable requirements may include NIST SP800-171, CMMC, HIPAA, University information security requirements,federal contractual obligations, and other sponsor or regulatoryrequirements in relation to Linux and/or Windows.

Learn more about the great benefits of working forUniversity of Utah: benefits.utah.edu

Responsibilities

• Maintain and reconcile System Security Plans, POA&Ms,control implementation statements, findings, risks, and relatedcompliance documentation.
• Lead preparation for mock audits, security assessments, sponsorreviews, and other compliance evaluations.
• Evaluate security evidence for sufficiency, currency,relevance, and traceability to applicable requirements.
• Coordinate evidence requests and control validation with CHPCtechnical subject-matter experts.
• Track findings and remediation activities, including owners,milestones, dependencies, target dates, and closure evidence.
• Draft and maintain security policies, procedures, standards,organizationally defined parameters, and other governancedocumentation.
• Research and interpret cybersecurity, regulatory, contractual,and institutional requirements affecting CHPC regulatedenvironments.
• Maintain operational compliance workflows within Hyperproof orother GRC platforms, including controls, evidence, assessments,findings, and remediation tracking.
• Perform quality reviews to identify inconsistencies amongsecurity documentation, control records, evidence, policies, andactual practices.
• Develop compliance and assurance reporting for assessmentreadiness, evidence status, open findings, remediation progress,and upcoming requirements.
• Coordinate complex compliance matters with UniversityInformation Security, GRC, Privacy, Research Security, IRB, Legal,contracting offices, and other institutional partners.
• Provide compliance and documentation support following securityincidents or significant control changes.
• Provide subject-matter guidance and peer collaboration to otherteam members as appropriate.

Minimum Qualifications

EQUIVALENCY STATEMENT: 1 year of higher education can be substituted for 1 year of directly related work experience (Example: bachelor's degree = 4 years of directly related workexperience).

Information Systems Auditor, IV: Requires abachelor's (or equivalency) + 8 years or a master's (orequivalency) + 6 years of directly related work experience.

Demonstrated ability to:

• Independently research and interpret security and compliancerequirements.
• Develop and maintain professional security and compliancedocumentation.
• Evaluate security controls and supporting evidence.
• Utilize strong project and workflow discipline, including theability to manage multiple findings, evidence requests,assessments, remediation activities, owners, dependencies, andcompliance deadlines concurrently.
• Communicate and knowledge share effectively with both technicaland nontechnical stakeholders.
• Feel comfortable exercising independent judgment in complex orambiguous compliance matters.

Preferences

• Experience with NIST SP 800-171, NIST SP 800-171A, CMMC, NISTSP 800-53, HIPAA, or comparable security and privacyframeworks.
• Experience preparing for or coordinating cybersecurity audits,mock audits, assessments, sponsor reviews, or complianceevaluations.
• Experience developing or maintaining SSPs, POA&Ms, securitypolicies, control narratives, governance documents, assessmentevidence, or continuous-compliance programs.
• Experience with Hyperproof or another governance, risk, andcompliance platform.
• Experience supporting higher education, research computing,high-performance computing, regulated research, government, orfederally sponsored research environments.
• Experience translating technical security implementations intoclear, defensible compliance documentation and evidencerequirements.
• Professional certification such as CISA, CGRC, CRISC, CISSP,Security+, or a comparable cybersecurity, audit, risk, orcompliance credential.

Requisition Number:

PRN46655B

Full Time or Part Time?

Full Time

Work Schedule Summary:

Monday – Friday 8am-5pm

Department:

00640 - CHPC Ctr for High PerformComputing

Location:

Campus

Pay Rate Range:

$64,122 - $124,278

Close Date:

01/29/2027