Research Cybersecurity Analyst

San Diego State University seeks a Research Cybersecurity Analyst to turn cybersecurity, contractual, regulatory, and sponsor requirements into secure, compliant safeguards for research environments.

• Review research proposals, solicitations, contracts, subcontracts, awards, and data-use agreements to identify cybersecurity, privacy, data-handling, and reporting requirements.
• Perform risk, gap, and control readiness assessments; recommend security approaches, remediation strategies, and risk-treatment options.
• Partner with researchers, research administration, IT, research computing, and privacy, legal, export control, and compliance teams to interpret and implement applicable requirements.
• Interpret sponsor and contractual cybersecurity requirements, including flow-down clauses, reporting obligations, data-handling restrictions, security milestones, and assessment expectations.
• Translate contract and regulatory requirements into controls, responsible parties, evidence, and remediation plans.
• Assess research data, systems, and workflows to identify indicators of CUI
  , FCI
  , PHI
  , PII
  , export-controlled information, or other restricted data.
• Define and document the scope and boundaries of research environments, including users, cloud services, third-party providers, endpoints, networks, and research equipment.
• Explain cybersecurity requirements in practical terms to researchers and research-support personnel.
• Coordinate, support, and validate security controls across cloud and on-premises research environments.
• Assess security architectures and configurations, including identity and access management, network segmentation, encryption, endpoint protection, logging, vulnerability management, and secure configuration.
• Identify security gaps and coordinate remediation.
• Support the design, review, and ongoing maintenance of secure research environments and research enclaves.
• Develop and maintain SSPs
  , POA&Ms
  , inventories, procedures, diagrams, and compliance evidence.
• Support sponsor inquiries, audits, and assessments, including CMMC readiness
  .
• Support vulnerability monitoring, remediation, and research-focused incident readiness.
• Maintain documentation and processes that demonstrate continued compliance and operational effectiveness after initial assessment or authorization.

• Experience implementing or assessing NIST SP 800-171
  , CMMC
  , NIST SP 800-53
  , or comparable security frameworks, including developing or maintaining SSPs
  , POA&Ms
  , control evidence, and assessment documentation.
• Experience securing Windows
  , Linux
  , cloud
  , or research computing environments, including identity and access management, encryption, network segmentation, secure configuration, logging, and vulnerability management.
• Ability to conduct security risk, gap, and control assessments, identify remediation or risk-treatment options, and support audit or assessment readiness.
• Ability to translate sponsor, contractual, regulatory, and security requirements into technical and procedural controls and communicate them effectively to researchers, technology teams, and leadership.
• Working knowledge of research-security requirements, including learning and applying requirements related to CUI/FCI
  , privacy, federal research awards,
  HIPAA
  -regulated information, export controls, and controlled-access research data.
• Experience assessing cloud, vendor, and third-party security, including shared-responsibility models and contractual security requirements.
• Strong communication, collaboration, and project management skills for managing multiple initiatives across technical, research, administrative, and compliance teams.
• Ability to handle confidential, regulated, and sensitive information and adapt to evolving technologies and security requirements.

• NIST SP 800-171
• CMMC
• NIST SP 800-53
• HIPAA Security Rule
• CUI, FCI, PHI, PII
• SSPs, POA&Ms
• Windows, Linux
• Cloud (Azure, AWS, Google Cloud)
• Identity and access management, network segmentation, encryption
• Endpoint protection, logging, vulnerability management, secure configuration
• CISSP, CISM, CCSP, Security+, CySA+, GIAC

• 15 paid holidays, vacation, and sick leave
• CalPERS pension plan with retiree healthcare and reciprocal agreements with other California public retirement systems, including the UC
• Medical, dental, and vision options at low or no cost
• CSU tuition fee waiver for employees and eligible dependents
• Flex Cash
• Life and disability insurance
• Legal and pet plans
• Access to the library, campus events, employee groups,…