Senior Security Assurance & Compliance Analyst IV

Utah; Salt Lake City (UT); On-site; USD 64,000 - 124,000; Full time

Job summary

The University of Utah's CHPC Security & Compliance team seeks an experienced Analyst IV to own and drive the operational assurance lifecycle for sensitive research environments. You will manage documentation, evidence, findings, remediation, and governance to ensure ongoing assessment readiness.

Responsibilities include coordinating with university partners, interpreting requirements such as NIST SP 800-171/CMMC/HIPAA, and maintaining workflows in GRC platforms.

Qualifications

• Bachelor’s degree or equivalent with 8 years of related work experience, or master’s with 6 years of related work experience.
• Ability to independently research and interpret security and compliance requirements.
• Develop and maintain professional security and compliance documentation.
• Experience coordinating cybersecurity audits, mock audits, assessments, sponsor reviews, or compliance evaluations.

Responsibilities

• Maintain and reconcile System Security Plans, POA&Ms, control narratives, findings, risks, and related compliance documentation.
• Lead preparation for mock audits, security assessments, sponsor reviews, and other compliance evaluations.
• Evaluate security evidence for sufficiency, currency, relevance, and traceability to applicable requirements.
• Coordinate evidence requests and control validation with CHPC technical subject-matter experts.
• Track findings and remediation activities, including owners, milestones, dependencies, target dates, and closure evidence.
• Draft and maintain security policies, procedures, standards, and governance documentation.

Skills

Security governance

Documentation

Evidence management

GRC workflows

Audit coordination

Stakeholder communication

Education

Bachelor’s degree + 8 years

Master’s degree + 6 years

Tools

Hyperproof

GRC platforms

Job description

The University of Utah's CHPC Security & Compliance team seeks an experienced Analyst IV to own and drive the operational assurance lifecycle for sensitive research environments. You will manage documentation, evidence, findings, remediation, and governance to ensure ongoing assessment readiness.

Responsibilities include coordinating with university partners, interpreting requirements such as NIST SP 800-171/CMMC/HIPAA, and maintaining workflows in GRC platforms.