Information Security Engineer III - 531108

Job Summary: The Information Security Engineer III assists with oversight of a comprehensive information security program to ensure security technology, tools, processes, procedures, reporting, and remediation are put into place and maintained to protect the University’s computing assets from unauthorized access, modification, destruction, or disclosure. Operates various high-complexity security infrastructure components. Monitors and maintains security tools and systems. Backs up triage of alerts, tickets, and incidents as needed. Assists and guides Security Analysts in resolution of alerts as needed. Conducts risk assessments, security compliance reviews, and vulnerability assessments. Researches regulatory, risk, threat information, new regulations or changes to existing regulations and new risk or threat information. Initiates changes in security technology, processes, and policies. Completes training annually to increase security knowledge and skills., Additional Department Summary: The Information Security Engineer III assists with oversight of a comprehensive information security program to ensure security technology, tools, processes, procedures, reporting, and remediation are put into place and maintained to protect the University’s computing assets from unauthorized access, modification, destruction, or disclosure. Implements and operates various high-complexity security infrastructure components. Is responsible for administering, maintaining, and improving the organization’s information security tools including data loss prevention (DLP) technologies across email, endpoint, and web. This role helps protect sensitive institutional data by configuring security controls, monitoring alerts, investigating potential data exposure events, and supporting policy enforcement across the organization’s technology environment.

In addition to DLP responsibilities, this position supports other enterprise security platforms, including secure web access gateways, anti-malware/endpoint protection tools, and other information security technologies. The Information Security Engineer III works closely with security operations, identity and access management, infrastructure, compliance, and business stakeholders to ensure security tools are effective, properly tuned, and aligned with organizational risk management goals. Backs up triage of alerts, tickets, and incidents as needed. Assists and guides security analysts and less senior engineers as needed. Conducts risk assessments, security compliance reviews, and vulnerability assessments. Research regulatory, risk, threat information, new regulations or changes to existing regulations and new risk or threat information. Initiates change in security technology, processes, and policies. Completes training annually to increase security knowledge and skills.

Required Minimum Qualifications: Master’s degree and two (2) years of IT security engineering experience; OR bachelor’s degree and four (4) years of IT security engineering experience; OR associate’s degree and six (6) years of IT experience to include four (4) years of IT security engineering; OR high school diploma or GED and eight (8) years of IT experience to include four (4) years of IT security engineering., Preferred Qualifications: Experience administering or supporting enterprise security technologies such as DLP, endpoint protection, email security, web filtering, secure web gateways, SIEM, or vulnerability management tools. Working knowledge of data protection concepts, including sensitive data discovery, data classification, encryption, access controls, and policy enforcement. Familiarity with regulatory and compliance requirements such as FERPA, HIPAA, GLBA, PCI DSS, CMMC, NIST, or other data protection frameworks. Familiarity with Microsoft 365 security tools, endpoint management platforms, directory services, and identity-based access controls.

The University of Alabama affirms its longstanding commitment to institutional neutrality, free speech, and academic freedom.