Senior Security & Risk Analyst (GRC & Compliance)

Ohio State University; Columbus (OH); On-site; USD 103,000 - 135,000; Full time

Job summary

The Ohio State University’s Office of Technology and Digital Innovation is seeking a Senior Security Analyst to design, manage, and evolve the information security and privacy framework across the university and medical center.

This role requires strong governance, risk management and compliance expertise, with leadership of Tier 1–3 assessments and cross-team collaboration. A bachelor’s degree and 6+ years in GRC are required.

Qualifications

• Bachelor’s degree in information technology, cyber security, computer science or related field.
• Minimum of 6 years of direct experience in information security governance, risk, and compliance.
• Full technology stack knowledge: IAM, servers, networking, application development, databases.

Responsibilities

• Own and operate IS/privacy control requirements (ISPCR) ensuring alignment with institutional goals.
• Map policies and controls to standards like NIST SP 800-53, HIPAA, FERPA, ISO 27001, SOC 2.
• Lead risk assessments (Tier 1-3) across campus infrastructure, cloud, and third-party vendors.
• Provide actionable mitigation strategies to system owners and technical teams.
• Mentor and guide less experienced colleagues across IT and security groups.
• Communicate complex risk information to diverse stakeholders and leadership.

Skills

Information security governance

Risk assessment

Compliance management

Communication to stakeholders

Education

Bachelor’s degree in IT/Cyber security

Tools

GRC tools

Job description

The Ohio State University’s Office of Technology and Digital Innovation is seeking a Senior Security Analyst to design, manage, and evolve the information security and privacy framework across the university and medical center.

This role requires strong governance, risk management and compliance expertise, with leadership of Tier 1–3 assessments and cross-team collaboration. A bachelor’s degree and 6+ years in GRC are required.