Security Awareness Analyst Senior

Assist Director Information Technology Security to implement information security plan and maintain application accesses for Information Systems supported by UVa Health System Computing Services.

This position requires to be on site once or twice a month. Preferred market DMV (DC, Maryland, Virginia).

Key Responsibilities

Enterprise Security Awareness & Training Program Leadership

* With guidance from the GRC Director, lead the UVA Health cybersecurity awareness and training program, including annual planning, execution, and continuous improvement.

* Develop and deliver role‑appropriate training for workforce members, including onboarding, annual refresher training, and targeted campaigns based on risk trends.

* Design, run, and continuously refine phishing simulation campaigns; analyze results, identify systemic risk patterns, and recommend corrective actions.

* Maintain program metrics and dashboards to demonstrate effectiveness, maturity, and risk reduction over time.

* Ensure documentation and evidence of training completion and program effectiveness are maintained to support audits and regulatory reviews.

Phishing & Social Engineering Risk Management

* Monitor and assess emerging phishing and social engineering techniques affecting healthcare organizations.

* Develop awareness content addressing real‑world attack scenarios (e.g., phishing, spear‑phishing, business email compromise, vishing, smishing).

* Partner with IT Security Operations and Incident Response teams to incorporate lessons learned from security incidents into training and awareness activities.

Compliance Assessments & Governance Support

* Serve as a senior contributor to cybersecurity and regulatory compliance assessments by coordinating evidence collection, validating control effectiveness, and supporting remediation tracking.

* Participate in periodic security risk assessments and governance activities aligned with UVA Health's cybersecurity risk management practices.

* Collaborate with Internal Audit, Compliance, and Privacy stakeholders to support internal and external audits and readiness activities.

Policy Development & Lifecycle Management

* Lead or co‑lead development, review, maintenance, and communication of IT security policies, standards, and procedures.

* Ensure policies reflect UVA Health governance expectations and are aligned with healthcare regulatory requirements and recognized cybersecurity frameworks.

* Coordinate policy lifecycle activities, including scheduled reviews, updates, approvals, and workforce communication.

Data Governance & Privacy Controls

* Apply and support cybersecurity controls related to data governance, data classification, and privacy protection for sensitive health and business information.

* Work closely with Privacy and Compliance teams to support appropriate handling of PHI and other regulated data across systems and workflows.

* Assist in identifying risks related to data access, use, and disclosure, and support mitigation strategies consistent with UVA Health standards.

Leadership & Collaboration

* Act as a subject matter expert and trusted advisor for security awareness, human‑centric risk, and governance topics across the health system.

* Influence without authority by partnering with clinical, operational, academic, and administrative stakeholders.

* Mentor junior staff or contribute expert guidance within cross‑functional initiatives as assigned.

MINIMUM REQUIREMENTS

Education:

Bachelor's degree

Experience:

5-7 years relevant experience. Relevant experience may be considered in lieu of a degree.

Licensure: CISSP or HCISPP required or actively working on and can demonstrate a plan to achieve

Preferred Qualifications

* Experience leading healthcare cybersecurity programs or academic health systems.

* Experience with phishing simulation platforms and awareness maturity metrics.

* Familiarity with NIST CSF, HIPAA security principles, and healthcare compliance expectations.

* Certifications such as CISSP, HCISP, CISM, CISA, Security + is preferred.

PHYSICAL DEMANDS

This is primarily a sedentary job involving extensive use of desktop computers. The job does occasionally require traveling some distance to attend…