> Markdown version of [/jobs/ext/3199993-senior-security-analyst](https://www.wearedevelopers.com/jobs/ext/3199993-senior-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Security Analyst - **Company:** The Ohio State University - **Location:** Columbus, OH, United States - **Experience:** Expert - **Salary:** $103,000.0 - $134,500.0 - **Contract:** Permanent contract - **Skills:** Software as a Service, Cyber Security, Database Theory, Identity and Access Management, Information Security Management, PCI Data Security Standards, Software Engineering, Cloud Platform System, Information Technology, 3-tier Architectures, CIS Benchmarks, Service Stack - **Published:** September 10, 2026 - **Apply:** https://osu.wd1.myworkdayjobs.com/OSUCareers/job/Columbus-Campus/Senior-Security-Analyst_R159041-2 ## About the Role * Bachelor's degree in information technology, cyber security, computer science, or a related field (or equivalent professional experience). * Minimum of 6 years of direct experience in information security governance, risk, and compliance.* Full technology stack knowledge - broad understanding and ability to explain identity and access management (IAM), server, networking, application development and database concepts. Preferred Education & Experience * 8 to 12 years of relevant governance, risk, and compliance (GRC) experience, ideally within a higher education, academic medical center, or highly decentralized corporate environment. * Advanced degree (master's or equivalent) in a relevant technical or business field. * Active professional certifications such as CISA, CRISC, CISM, CISSP, or equivalent specialized GRC certifications. * Deep specialization in NIST SP 800-53 and HIPAA Security/Privacy Rules. Thorough understanding of how these controls apply to diverse IT environments (on-premises, cloud, SaaS). * Full technology stack experience - provides expert guidance to securely implement IAM, server, networking, application development and database services. ## Description The Senior Security Analyst is a high-impact, specialized position within The Ohio State University's Office of Technology and Digital Innovation. This role is responsible for designing, managing, and evolving the comprehensive information security and privacy framework across the university and medical center. Operating with a high degree of autonomy, the Senior Security Analyst will apply advanced industry knowledge to solve highly complex problems, develop new risk models, establish precedents that safeguard the university's academic, research, and administrative environments, and lead technical focus groups to determine the applicability of industry standards to university business., * Own and operate the university's Information Security and Privacy Control Requirements (ISPCR), ensuring alignment with institutional goals. * Map institutional policies and controls to industry standards and regulatory requirements, such as NIST SP 800-53, NIST SP 800-171, CIS Benchmarks, HIPAA, FERPA, GLBA, and PCI-DSS.CIS Controls, ISO/IEC 27001, SOC 2, HIPAA, FERPA, GLBA, PCI DSS, or similar. * Develop, refine, and implement new compliance practices, processes, maturity models, and key performance metrics to measure framework effectiveness over time. * Lead highly complex, large-scope risk assessment initiatives that have a significant and long-term impact on the university's risk posture. * Scope, execute, and oversee Tier 1, Tier 2, and Tier 3 risk assessments, evaluating critical campus infrastructure, cloud environments, third-party vendors, and research data environments. * Provide actionable, technically sound mitigation strategies to system owners, researchers, and technical teams to remediate identified gaps. * Provide guidance, mentorship, and technical oversight to less experienced colleagues across the distributed university IT and security organizations. * Convey difficult, highly complex, or sensitive risk information to diverse campus stakeholders and leadership, from technical system administrators to non-technical academic leadership. * Facilitate productive dialogue and use advanced communication skills to persuade ## Related Videos - [A practical guide to writing secure Dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Introducing a Digital Service Catalog for speed and scale](https://www.wearedevelopers.com/videos/763-introducing-a-digital-service-catalog-for-speed-and-scale) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [OPA for the cloud natives](https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)