> Markdown version of [/jobs/ext/4390010-research-cybersecurity-analyst-information-security-analyst-iii](https://www.wearedevelopers.com/jobs/ext/4390010-research-cybersecurity-analyst-information-security-analyst-iii). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Research Cybersecurity Analyst (Information Security Analyst III) - **Company:** San Diego State University - **Location:** San Diego, CA, United States (Remote available) - **Salary:** $87,408.0 - $127,332.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Amazon Web Services, Computing Platforms, Microsoft Azure, Cloud Computing, Cloud Computing Security, CompTIA Security+, Cyber Security, Information Systems, Linux, Identity and Access Management, Information Technology Audit, Information Systems Security Architecture Professional, Network Security, Network Segmentation, Cloud Services, Software Vulnerability Management, Data Logging, Google Cloud, Information Technology, Data Management - **Published:** October 2, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=ed58c68ce8607157 ## About the Role We are looking for a cybersecurity professional who can evaluate security requirements, understand how they apply to research environments, identify practical safeguards, and work collaboratively with technical and nontechnical stakeholders to implement and document those safeguards. The successful candidate may have developed this experience through cybersecurity operations, governance, risk, and compliance work, IT auditing, cloud security, systems administration, research computing, compliance consulting, or a related area. Experience in the following areas is especially valuable: * NIST SP 800-171, CMMC, NIST SP 800-53, or similar security frameworks * Security controls, assessments, and compliance documentation * SSPs, POA&Ms, or audit/assessment readiness * Windows, Linux, cloud, or enterprise environments * Identity and access management, encryption, vulnerability management, or network security * Communicating technical or compliance requirements to different audiences Experience working in a higher-education, research, healthcare, government, defense, or other highly regulated environment is a plus., An equivalent to bachelor's degree in a related field and four years of relevant experience. Additional experience which demonstrates acquired and successfully applied knowledge and abilities shown above may be substituted for the required education on a year-for-year basis. An advanced degree in a related field may be substituted for the required experience on a year-for-year basis., * Experience implementing or assessing NIST SP 800-171, CMMC, NIST SP 800-53, or comparable security frameworks, including developing or maintaining SSPs, POA&Ms, control evidence, and assessment documentation. * Experience securing Windows, Linux, cloud, or research computing environments, including controls such as identity and access management, encryption, network segmentation, secure configuration, logging, and vulnerability management. * Ability to conduct security risk, gap, and control assessments, identify appropriate remediation or risk-treatment options, and support audit or assessment readiness. * Ability to translate sponsor, contractual, regulatory, and security requirements into practical technical and procedural controls and communicate them effectively to researchers, technology teams, and leadership. * Working knowledge of research-security requirements and the ability to learn and apply requirements related to CUI/FCI, privacy, federal research awards, HIPAA-regulated information, export controls, and controlled-access research data. * Experience assessing cloud, vendor, and third-party security, including shared-responsibility models and contractual security requirements. * Strong communication, collaboration, and project management skills, with the ability to manage multiple security initiatives and work effectively across technical, research, administrative, and compliance teams. * Ability to appropriately handle confidential, regulated, and sensitive information and adapt to evolving technologies and security requirements. * Preferred Qualifications + Advanced degree in cybersecurity, information security, computer science, information systems, engineering, or a related field and/or additional progressively responsible cybersecurity experience. + Experience supporting higher education or research environments, including secure research environments, CUI/FCI, CMMC readiness, HIPAA-regulated research, or cloud platforms such as Azure, AWS, or Google Cloud. + Relevant cybersecurity, cloud, audit, or compliance certification, completed or in progress, such as CISSP, CISM, CCSP, Security+, CySA+, GIAC, CMMC, or another comparable certification. ## Description Categories: Unit 9 - CSUEU - Technical Support Services, Probationary, Full Time, Information Systems & Technology, Telecommute eligible (work onsite as scheduled and/or as requested and telecommute as scheduled), San Diego State University is seeking a Research Cybersecurity Analyst to help faculty and research teams and campus partners securely conduct research involving sensitive, regulated, and contractually restricted information. Working within SDSU's Information Technology Security Office, the Research Cybersecurity Analyst will translate cybersecurity, contractual, regulatory, and sponsor requirements, including NIST SP 800-171, CMMC, NIST SP 800-53, and the HIPAA Security Rule and related requirements, into practical technical, administrative, and procedural safeguards. You'll assess research environments, help implement security requirements, maintain compliance documentation, coordinate remediation, and help prepare research projects for sponsor inquiries, audits, and formal assessments. The position will work collaboratively with researchers, research administration, research computing, central IT, privacy, legal, export control, compliance, and other campus partners to help research teams meet security obligations while maintaining an effective and usable research environment. What You'll Do: Research Security & Consultation * Review research proposals, solicitations, contracts, subcontracts, awards, and data-use agreements to identify cybersecurity, privacy, data-handling, and reporting requirements. * Conduct risk, gap, and control readiness assessments and recommend practical security approaches, remediation strategies, and risk-treatment options. * Work with researchers, research administration, IT teams, research computing, and privacy, legal, export control, and compliance partners to interpret and implement applicable requirements. * Interpret contractual and sponsor cybersecurity requirements, including flow-down clauses, reporting obligations, data-handling restrictions, security milestones, and assessment expectations. * Map contract and regulatory requirements to applicable controls, responsible parties, evidence, and remediation plans. * Assess research data, systems, and workflows for indicators of CUI, FCI, PHI, PII, export-controlled information, or other restricted data. * Establish and document the scope and boundaries of research environments, including users, cloud services, third-party providers, endpoints, networks, and research equipment. * Explain cybersecurity requirements in practical terms to researchers and research-support personnel who may not have a cybersecurity background. Security Controls & Research Environments * Coordinate, support, and validate security controls across cloud and on-premises research environments. * Assess security architectures and configurations involving identity and access management, network segmentation, encryption, endpoint protection, logging, vulnerability management, and secure configuration. * Evaluate security gaps and coordinate appropriate remediation. * Support the design, review, and maintenance of secure research environments and research enclaves. Compliance & Readiness * Develop and maintain SSPs, POA&Ms, inventories, procedures, diagrams, and compliance evidence. * Help prepare research environments for sponsor inquiries, audits, and assessments, including CMMC readiness. * Support vulnerability monitoring, remediation, and research-focused incident readiness. * Maintain documentation and processes needed to demonstrate continued compliance and operational effectiveness after an initial assessment or authorization., * Support research securely - Help researchers meet cybersecurity requirements while moving their work forward. * Work across cybersecurity and compliance - Gain exposure to technical controls, risk assessments, documentation, and assessment readiness. * Collaborate across SDSU - Work with researchers, IT professionals, and compliance partners on a variety of research security needs. * Solve different security challenges - Support research projects with varying technologies, data, sponsors, and security requirements., The person holding this position is considered a 'mandated reporter' under the California Child Abuse and Neglect Reporting Act and is required to comply with the requirements set forth in CSU Executive Order 1083 as a condition of employment. San Diego State University is not a sponsoring agency for staff or management positions (e.g., H-1B visa). Applicants must currently be authorized to work in the United States on a full-time basis. Offers of employment are contingent upon the presentation of documents that demonstrate a person's identity and authorization to work in the United States, which are consistent with the provisions of the Immigration Reform and Control Act. Education Code 89521 Requirements: Applicants will be required to disclose whether they have received a final administrative decision or final judicial decision determining that they have committed sexual harassment within the last 7 years only after a determination is made that they meet the minimum qualifications for the position, and before an offer of employment is extended. Applicants who reach the final stages of the application process must also sign a release form that authorizes the release of information by the applicant's current and/or former employers to the CSU concerning any substantiated allegations of misconduct. A background check (including a criminal records check) must be completed satisfactorily and is required for employment. SDSU will make a conditional offer of employment, which may be rescinded if the background check reveals disqualifying information, and/or it is discovered that the candidate knowingly withheld or falsified information. Failure to satisfactorily complete the background check may affect the continued employment of a current SDSU employee who was conditionally offered the position.