Principal Cybersecurity Analyst - Governance, Risk, Compliance

Leads the Cybersecurity Risk & Compliance Program by defining program strategy, developing/improving core processes, managing daily workflows, and directing the team to manage cybersecurity risk and compliance across the institution’s application, server, and cloud assets for stakeholders.

Cybersecurity Risk & Compliance Program Leadership & Governance
Lead the operations and strategic direction of the institution’s cybersecurity risk and compliance program across application, server, and cloud assets to identify, assess, treat, and monitor risk and protect patient care, research, and clinical operations.

Conduct and oversee risk and compliance assessments, control assurance, and risk-register management, and drive strategic improvements to program governance, methodologies, and workflow efficiency.

Establish and refine program standards, policies, and procedures aligned with institutional risk tolerance and regulatory and compliance requirements (e.g., NIST, HIPAA, HITRUST).

Team Supervision, Guidance & Subject Matter Expertise
Supervise, mentor, and develop a team of cybersecurity risk and compliance analysts; set priorities, manage workload, and support professional growth and performance.

Serve as the subject matter expert for cybersecurity risk and compliance, providing technical guidance, escalation support, and coaching to team members.

Foster a culture of accountability, collaboration, and continuous improvement.

Cross-Functional Partnerships & Collaboration
Develop and enhance partnerships with IT, infrastructure, application, cloud, and business and clinical support teams to improve cross-functional effectiveness and collaboration.

Coordinate risk assessment and remediation activities with system, application, and cloud service owners, ensuring shared understanding of risk, priorities, and timelines.

Serve as a liaison between Cybersecurity and support teams to resolve barriers and drive timely, effective risk treatment.

Performance Monitoring & Structured Program Reviews
Conduct structured weekly and monthly reviews to ensure alignment on issues, updates, and performance data.

Define, track, and report key performance indicators (KPIs) and key risk indicators (KRIs) to measure program health and inform data-driven decisions.

Identify trends, gaps, and improvement opportunities from risk and performance data and take corrective action.

SLA Management & Cybersecurity Point of Contact
Serve as the point of contact for Cybersecurity to ensure risk and compliance service level agreements (SLAs) are consistently met.

Monitor SLA compliance, escalate at-risk items, and coordinate risk treatment to meet or exceed defined targets.

Communicate program status, risks, and SLA performance to leadership and stakeholders.

Program Documentation & Reporting
Develop and maintain comprehensive program documentation, including risk assessments, the risk register, standard operating procedures, and reporting, to ensure accuracy, clarity, and auditability.

Ensure documentation supports consistent execution, onboarding, knowledge transfer, and audit readiness.

Leadership Support & Special Assignments
Complete designated tasks, projects, and responsibilities as assigned by leadership.

Support departmental and institutional cybersecurity initiatives and continuous improvement efforts as needed.

Other duties as assigned
 

EDUCATION

• Required: Bachelor's Degree Computer Information Systems, Business Information Systems, Computer Science or related field.
• Preferred: Master's Degree Information Security, Computer Science or related field

WORK EXPERIENCE

• Required: 7 years In information security and/or cybersecurity experience including multiple security domains, to include two years lead/supervisory experience.
• May substitute required education degree with additional years of equivalent experience on a one to one basis.
• Preferred: Professional experience in Governance, Risk, Compliance, experience developing, leading, or supporting a cybersecurity program. 

LICENSES AND CERTIFICATIONS

• Preferred: CISSP - Cert IS Security Professional Issued by the International Information Systems Security Certification Consortium ((ISC).
• Preferred: CISM - Cert Info Security Manager Issued by Information Systems Audit and Control Association (ISACA).
• Preferred: PMP - Project Mgt Professional Issued by the Project Management Institute (PMI). 
• Preferred: Other applicable security industry certifications. 

The University of Texas MD Anderson Cancer Center offers excellent benefits, including medical, dental, paid time off, retirement, tuition benefits, educational opportunities, and individual and team recognition.

This position may be responsible for maintaining the security and integrity of critical infrastructure, as defined in Section 113.001(2) of the Texas Business and Commerce Code and therefore may require routine reviews and screening. The ability to satisfy and maintain all requirements necessary to ensure the continued security and integrity of such infrastructure is a condition of hire and continued employment.

It is the policy of The University of Texas MD Anderson Cancer Center to provide equal employment opportunity without regard to race, color, religion, age, national origin, sex, gender, sexual orientation, gender identity/expression, disability, protected veteran status, genetic information, or any other basis protected by institutional policy or by federal, state, or local laws unless such distinction is required by law.http://www.mdanderson.org/about-us/legal-and-policy/legal-statements/eeo-affirmative-action.html