Information Security Analyst

Harvard Medical School nurtures a diverse group of leaders and future leaders in both clinical care and biomedical inquiry who are on the front lines of medicine and science serving individuals and populations locally, nationally, and globally. The Information Technology Department at Harvard Medical School enables this mission by delivering secure and scalable services. Digital Identity is a key underpinning of the digital transformation strategy driving trust and seamless experiences for our incredibly talented community. The Security team in the Harvard Medical School Department of Information Technology is seeking an Information Security Analyst to help build and sustain Vulnerability, Cloud and DLP Management solutions and to provide critical operational support for HMS infrastructure. This position offers a breadth of opportunity, ranging from traditional on-prem systems and solutions to contemporary cloud solutions. The Information Security Analyst will work collaboratively with all departments within HMS IT and Harvard University IT. PRINCIPAL DUTIES AND RESPONSIBILITIES: • Operate recurring vulnerability and compliance reporting, quality-check results, and distribute reports to HMS groups on schedule. • Advise system administrators on findings and remediation, and track issues through to verified closure. • Run day-to-day execution of the endpoint security compliance effort, ensuring required security agents are deployed and healthy. • Monitor cloud security posture, triage misconfigurations, and work with cloud owners to remediate findings. • Support vendor risk management, including security reviews and follow-up on identified issues. • Triage data loss prevention alerts and coordinate remediation of sensitive data on shared storage. • Support security assessments, penetration testing, and the security awareness program. • Build dashboards and reports, and use basic scripting to automate recurring tasks.   Basic Qualifications: • Minimum of five years’ experience post-secondary education or relevant work experience. Additional Qualifications and Skills: • Bachelor's degree in information systems, cybersecurity, or a related field. • Working knowledge of vulnerability management fundamentals, including CVE and CVSS, risk prioritization, and remediation timelines. • Demonstrated ability to obtain results from technical staff who do not report to you, with strong written and verbal communication skills. • Hands-on experience with enterprise vulnerability scanning, endpoint protection, or asset inventory tools. • Experience with cloud security posture management and common cloud misconfigurations. • Experience with vendor or third-party security risk assessments. • Experience with data loss prevention alert triage and sensitive data remediation. • Experience with endpoint management and agent deployment at scale. • Experience with IT service management or GRC ticketing and reporting. • Familiarity with HIPAA, NIST SP 800-53, the NIST Cybersecurity Framework, or comparable frameworks. • Experience in higher education, an academic medical center, or a research environment, especially with decentralized IT groups. • Strong problem-solving skills, attention to detail, and the ability to act as a trusted advisor. Certificates and Licenses: • SecAI+ • Security+ • PenTest+ • CCSK • Cloud+ • Standard Hours/Schedule: 35 hours per week. • Visa Sponsorship Information: Harvard University is unable to provide visa sponsorship for this position. • Pre-Employment Screening: Identity, Criminal. • Interview Format:  All interviews will be conducted remotely using a video conferencing platform.  • Staying Informed About Your Application: Due to the high volume of applications, we may not always be able to