Information Security Analyst II

Job Summary

Job Description

Typical duties include but are not limited to:

• Administers and maintains identity and access management (IAM) controls, including roles, permission sets, query and report access, component interfaces, and automated process groups, in alignment with least-privilege principles.
• Designs and maintains security items such as roles, permission lists, query and report access, component interfaces, and batch process groups.
• Detects, investigates, and resolves security events, policy violations, and anomalous activity; documents findings and escalates incidents in accordance with the university’s incident response procedures.
• Identifies, reports, and resolves security violations.
• Manages user provisioning and de-provisioning workflows, evaluates access requests against established role definitions, and troubleshoots authentication and authorization issues across enterprise platforms.
• Administers security aspects for users, identifies appropriate security accesses, and troubleshoots security and access issues.
• Partners with IT and academic units to assess security risks, drive process improvements, and ensure that security controls are effectively integrated into operational workflows and project delivery.
• Collaborates with users to maintain and improve information security processes and procedures.
• Maintains accurate security documentation, including asset records, acceptable use guidance, network security standards, and evidence artifacts required for audit and compliance purposes.
• Maintains records, forms, and documents the proper use of the network.
• Tracks and manages security-related work requests, incidents, and projects using the IT service management (ITSM) platform, ensuring timely resolution and accurate reporting.
• Completes tracking in the work order system.
• Conducts periodic access certification reviews and user entitlement audits to verify compliance with established security standards, FERPA, HIPAA, PCI-DSS, and other applicable regulatory requirements.
• Conducts access review audits to ensure compliance with established security standards and policy guidelines.
• Designs and implements data protection controls, including encryption, data loss prevention (DLP) configurations, and secure data handling procedures to reduce exposure from unauthorized access or exfiltration.
• Develops new techniques and procedures to protect data from unauthorized users.
• Continuously evaluates security processes and tool effectiveness; develops recommendations for control improvements and promotes adoption of current security frameworks and industry best practices.
• Reviews processes, evaluates results, recommends new processes, and promotes best practices.
• Identifies capability gaps in the university’s security posture, develops business cases for security investments, and leads or contributes to implementation projects that advance institutional security objectives.
• Identifies the need for functionalities that enhance the organization's security posture and manages projects to implement these enhancements.

Other Duties:

• Performs other job-related duties as assigned.

Additional Job Description

Required Qualifications:

• This position requires either seven years of directly related full-time experience or, as an alternative, a Bachelor’s degree from an accredited institution in computer science, business administration, or related field and three years of full-time experience directly related to the job functions.
• Professional full-time experience working with wide and local area networks, business applications development and support, systems security, or related experience.
• Any appropriate combination of relevant education, experience, and/or certifications may be considered.

Preferred Qualifications:

• Three years full time professional experience working with wide and local area networks or business applications development and support.
• Security specific certifications such as GIAC, CEH, or CISSP.
• Experience working with CIS Critical Controls or NIST 800 series documents.
• Experience working in Higher Education.

Knowledge, Skills & Abilities:

• Proven ability to think strategically and approach challenges with creativity.
• Demonstrated track record of reliability, meeting goals, and holding oneself accountable.
• Strong interpersonal skills and experience working effectively across teams.
• Knowledge of security strategies (operating system hardening, vulnerability management, change management, application testing/patching, security tools, and software products).Knowledge of modern security domains including endpoint and OS hardening, vulnerability and patch management, identity and access management, cloud security, application security testing, and security tooling (SIEM, EDR, DLP, IDS/IPS).
• Knowledge of network/system security access, management, and testing.
• Knowledge of network and system security principles, including segmentation, access control architectures, zero trust concepts, and security testing methodologies.
• Knowledge of applicable security policies, best practices, and principles.
• Knowledge of standard computer logging processes and understanding of the types of events logged.
• Skill in identifying complex problems and reviewing related information to develop and evaluate options and implement solutions.
• Excellent interpersonal skills.
• Advanced verbal and written communication skills and the ability to present effectively to small and large groups.
• Ability to take initiative to plan, organize, coordinate and perform work in various situations when numerous and competing demands are involved.
• Ability to collaborate and work effectively within the community and willing to contribute to a team effort.
• Ability to work independently and follow through on assignments.
• Ability to translate security concepts to all areas of the business.Ability to communicate security risk and technical concepts clearly to both technical and non-technical audiences, including faculty, senior leadership, and end users.
• Ability to interpret log data and investigate potential issues.Ability to analyze SIEM alerts, log data, and security telemetry to identify indicators of compromise, anomalous behavior, or emerging threats, and triage findings for investigation or escalation.
• Ability to prepare network/system diagrams and advise on secure implementations of systems and services.Ability to develop network and system security architecture diagrams and provide guidance on secure design principles, configuration baselines, and hardening standards for infrastructure and cloud environments.
• Ability to discern between security breaches and more innocent technical bugs.Ability to apply sound analytical judgment to differentiate genuine security incidents from false positives, technical misconfigurations, or benign anomalies, reducing alert fatigue and improving response quality.

Institutional Values & Behavioral Expectation:

In this role, the successful candidate will be expected to:

• Seek out new approaches to improve outcomes; remain open for feedback and new ideas.
• Lead with integrity; consistently produce high-quality work; persevere to overcome obstacles to meet deadlines and achieve deliverables.
• Share information and insights thoughtfully; build partnerships across departments; communicate respectfully; support colleagues to achieve common goals.

Pay Grade 18

FGCU is a State University System of Florida member and an Equal Opportunity and Equal Access employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, disability, or protected veteran status.