Information Security Analysts

Job Summary

Information Security Analysts (Cybersecurity Analyst Tier 3, Security Operations Center) support the University’s Information Security and Compliance goals. The Tier 3 SOC analyst is the senior escalation point, leading complex investigations while driving detection engineering, automation, and continuous improvement initiatives. The role blends investigative expertise with technical capabilities to improve detection fidelity, reduce response times, and strengthen organizational security.

The University Information Technology (UIT) is the central IT service provider for the University of Utah. It reports to the Chief Information Officer and manages IT services including security.

• Lead the end‑to‑end incident response lifecycle, including triage, investigation, containment, eradication, and post‑incident analysis across endpoint, network, cloud, and identity domains.
• Serve as the senior escalation point for Tier 2 analysts, providing technical direction and oversight for complex investigations.
• Perform digital forensics to support root‑cause analysis, adjust security detections to address identified gaps, and develop post‑incident plans of action.

• Own detection strategy and coverage across key threat domains.
• Define telemetry requirements in partnership with security engineering and platform owners.
• Lead development of detection standards and quality metrics.
• Design and maintain detection logic across SIEM, EDR, and cloud platforms, ensuring high‑fidelity alerting through tuning, enrichment, and correlation of multi‑source telemetry.
• Identify detection gaps based on threat intelligence and incident‑response needs.
• Design, build, and maintain automation (SOAR) to improve triage, data enrichment, and response efficiency.
• Operationalize threat hunting and incident findings into scalable detection use cases and playbooks.

• Lead hypothesis‑driven threat hunting campaigns informed by threat intelligence, transforming findings into durable detections and response playbooks.
• Conduct proactive threat hunting to detect advanced adversarial activity not detected by existing controls.
• Analyze attacker behavior and map to known tactics, techniques, and procedures (TTP).
• Continuously evaluate detection coverage, proactively reducing false positives while increasing detection quality.

• Assist in mentoring and developing Tier 1/2 SOC analysts; conduct periodic investigation reviews to ensure quality.
• Drive improvement in SOC processes, workflows, and incident‑response playbooks.
• Produce clear, actionable after‑action reports and executive‑ready summaries for findings.
• Partner with internal IT teams to improve logging, telemetry, and observability across the environment.

EQUIVALENCY STATEMENT: One year of higher education can be substituted for one year of directly related work experience (e.g., bachelor’s degree equals four years of directly related work experience).

Information Security Analyst, IV: Requires a bachelor’s (or equivalency) and 8 years, or a master’s (or equivalency) and 6 years of directly related work experience.

Information Security Analyst, V: Requires a bachelor’s (or equivalency) and 10 years, or a master’s (or equivalency) and 8 years of directly related work experience.

Information Security Analyst, VI: Requires a bachelor’s (or equivalency) and 12 years, or a master’s (or equivalency) and 10 years of directly related work experience.

Information Security Analyst, VII: Requires a bachelor’s (or equivalency) and 14 years, or a master’s (or equivalency) and 12 years of directly related work experience.

• Strong operational security background.
• Experience conducting hands‑on analysis of large volumes of logs, network data, and other attack artifacts during incident investigations.
• Extensive experience leveraging SIEM and SOAR platforms to analyze diverse log types and events across multiple data sources, applying behavioral, statistical, and machine learning techniques to detect and respond to advanced threats.
• Strong understanding of the network threat lifecycle, attack vectors, and…