Research Cybersecurity Analyst; Information Security Analyst III

Job no: 562498
Work type: Staff
Location: San Diego
Categories: Unit 9 - CSUEU - Technical Support Services, Probationary, Full Time, Information Systems & Technology, Telecommute eligible (work onsite as scheduled and/or as requested and telecommute as scheduled)

San Diego State University is seeking a Research Cybersecurity Analyst to help faculty and research teams and campus partners securely conduct research involving sensitive, regulated, and contractually restricted information. Working within SDSU’s Information Technology Security Office, the Research Cybersecurity Analyst will translate cybersecurity, contractual, regulatory, and sponsor requirements, including NIST SP 800-171, CMMC, NIST SP 800-53, and the HIPAA Security Rule and related requirements, into practical technical, administrative, and procedural safeguards.

You’ll assess research environments, help implement security requirements, maintain compliance documentation, coordinate remediation, and help prepare research projects for sponsor inquiries, audits, and formal assessments.
The position will work collaboratively with researchers, research administration, research computing, central IT, privacy, legal, export control, compliance, and other campus partners to help research teams meet security obligations while maintaining an effective and usable research environment.

• Review research proposals, solicitations, contracts, subcontracts, awards, and data-use agreements to identify cybersecurity, privacy, data-handling, and reporting requirements.
• Conduct risk, gap, and control readiness assessments and recommend practical security approaches, remediation strategies, and risk-treatment options.
• Work with researchers, research administration, IT teams, research computing, and privacy, legal, export control, and compliance partners to interpret and implement applicable requirements.
• Interpret contractual and sponsor cybersecurity requirements, including flow-down clauses, reporting obligations, data-handling restrictions, security milestones, and assessment expectations.
• Map contract and regulatory requirements to applicable controls, responsible parties, evidence, and remediation plans.
• Assess research data, systems, and workflows for indicators of CUI, FCI, PHI, PII, export-controlled information, or other restricted data.
• Establish and document the scope and boundaries of research environments, including users, cloud services, third-party providers, endpoints, networks, and research equipment.
• Explain cybersecurity requirements in practical terms to researchers and research-support personnel who may not have a cybersecurity background.

• Coordinate, support, and validate security controls across cloud and on-premises research environments.
• Assess security architectures and configurations involving identity and access management, network segmentation, encryption, endpoint protection, logging, vulnerability management, and secure configuration.
• Evaluate security gaps and coordinate appropriate remediation.
• Support the design, review, and maintenance of secure research environments and research enclaves.

• Develop and maintain SSPs, POA&Ms, inventories, procedures, diagrams, and compliance evidence.
• Help prepare research environments for sponsor inquiries, audits, and assessments, including CMMC readiness.
• Support vulnerability monitoring, remediation, and research-focused incident readiness.
• Maintain documentation and processes needed to demonstrate continued compliance and operational effectiveness after an initial assessment or authorization.