> Markdown version of [/jobs/ext/2693734-information-security-risk-analyst-2](https://www.wearedevelopers.com/jobs/ext/2693734-information-security-risk-analyst-2). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Risk Analyst 2 - **Company:** ScienceJobs.Org - **Location:** Minneapolis, MN, United States - **Salary:** $85,000.0 - $95,000.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, Open Web Application Security, PCI Data Security Standards, Control Structures, Data Analytics - **Published:** September 3, 2026 - **Apply:** https://sciencejobs.org/job/job/apply?id=7367225 ## About the Role Bachelor's degree in a related field and 2 years of relevant work experience or a Master's degree. 1 year experience in information security risk assessment, audit, quality assurance,or similar. Excellent communication (oral, written, presentation), interpersonal and consultative skills., Relevant work experience in a technical role, such as enterprise system management, or working within an IT-role in higher education Knowledge of information security standards (e.g., ISO 27001/27002, NIST 800-171.), rules and regulations related to information security and data confidentiality (e.g., FERPA, GLBA, PCI DSS, HIPAA) CISSP, CISA, or other security certifications are desirable. Strong capability to analyze complex, ambiguous situations and synthesize conflicting information into clear, data-driven risk recommendations. Demonstrated ability to look beyond surface-level technical symptoms to identify underlying root causes of systemic risk. ## Description Security Analysis - 80% Conduct information security assessments utilizing ISO 27001 / 27002, NIST 800-171 or other appropriate information security control structures; develop risk remediation plans, and facilitate risk remediation efforts. Facilitate the information security risk management program by identifying areas most in need of risk assessment, coordinating risk assessments with other information security risk analysts, and consulting with information security architects. Monitor and advise on information security needs for systems and processes at the University of Minnesota to ensure the information security controls for the campuses are consistent and appropriate. Consult with administrative and collegiate units to address policy and process-related information security risks identified through the information security risk and exception management programs. Collaborate with stakeholders by translating complex technical vulnerabilities and control deficiencies into clear, business-risk language for non-technical academic and administrative leaders. Assist with development and maintenance of information security policies, standards, guidelines and procedures, based on industry best practices and compliance requirements. Maintain a strong working knowledge of regulatory frameworks impacting higher education, including GLBA, PCI and FERPA while building knowledge of applicable security standards (SANS, OWASP, NIST). Procedural Support - 20% Facilitate the exception management process by tracking exceptions to information security policies and standards, evaluating associated risks by working with the other information security staff, and coordinating communication with the risk owner. Assist with information security reviews of vendors and suppliers. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [PySpark - Combining Machine Learning & Big Data](https://www.wearedevelopers.com/videos/44-pyspark-combining-machine-learning-big-data) - [WebMCP - Making Agents a First-Class Citizen of the Web - Andre Cipriani Bandarra & François Beaufort](https://www.wearedevelopers.com/videos/1811-webmcp-making-agents-a-first-class-citizen-of-the-web-andre-cipriani-bandarra-francois-beaufort) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) ## Related Articles - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Data Analyst Salary in Switzerland](https://www.wearedevelopers.com/magazine/276-data-analyst-salary-in-switzerland) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)