Principal Cybersecurity Analyst - Vulnerability Management

Leads the Vulnerability Management Program by defining program strategy, developing/improving core processes, managing daily workflows, and directing the team to deliver efficient, consistent execution for stakeholders.

Vulnerability Management Program Leadership & Governance        
Lead the operations and strategic direction of the institution’s cybersecurity vulnerability management program to identify, prioritize, and remediate vulnerabilities and reduce risk to patient care, research, and clinical operations.

Develop and drive strategic improvements to program governance, processes, and workflow efficiency across the vulnerability management lifecycle.

Establish and refine program standards, policies, and procedures aligned with institutional risk tolerance and regulatory requirements.

Team Supervision, Guidance & Subject Matter Expertise        
Supervise, mentor, and develop a team of vulnerability management staff; set priorities, manage workload, and support professional growth and performance.

Serve as the subject matter expert for vulnerability management, providing technical guidance, escalation support, and coaching to team members.

Foster a culture of accountability, collaboration, and continuous improvement.

Cross-Functional Partnerships & Collaboration        
Develop and enhance partnerships with IT, infrastructure, application, and biomedical/clinical support teams to improve cross-functional effectiveness and collaboration.

Coordinate remediation efforts with system and application owners, ensuring shared understanding of risk, priorities, and timelines.

Serve as a liaison between Cybersecurity and support teams to resolve barriers and drive timely, effective remediation.

Performance Monitoring & Structured Program Reviews        
Conduct structured weekly and monthly reviews to ensure alignment on issues, updates, and performance data.

Define, track, and report key performance indicators (KPIs) and key risk indicators (KRIs) to measure program health and inform data-driven decisions.

Identify trends, gaps, and improvement opportunities from performance data and take corrective action.

SLA Management & Cybersecurity Point of Contact        
Serve as the point of contact for Cybersecurity to ensure vulnerability management service level agreements (SLAs) are consistently met.

Monitor SLA compliance, escalate at-risk items, and coordinate remediation to meet or exceed defined targets.

Communicate program status, risks, and SLA performance to leadership and stakeholders.

Program Documentation & Reporting        
Develop and maintain comprehensive program documentation, including standard operating procedures, runbooks, workflows, and reporting, to ensure accuracy, clarity, and auditability.

Ensure documentation supports consistent execution, onboarding, knowledge transfer, and audit readiness.

Leadership Support & Special Assignments        
Complete designated tasks, projects, and responsibilities as assigned by leadership.

Support departmental and institutional cybersecurity initiatives and continuous improvement efforts as needed.

Other duties as assigned
 

EDUCATION

• Required: Bachelor's Degree Computer Information Systems, Business Information Systems, Computer Science or related field.
• Preferred: Master's Degree Information Security, Computer Science or related field

WORK EXPERIENCE

• Required: 7 years In information security and/or cybersecurity experience including multiple security domains, to include two years lead/supervisory experience.
• May substitute required education degree with additional years of equivalent experience on a one to one basis.
• Preferred: Vulnerability Management experience, experience developing, leading, or supporting a cybersecurity program. 

LICENSES AND CERTIFICATIONS

• Preferred: CISSP - Cert IS Security Professional Issued by the International Information Systems Security Certification Consortium ((ISC)
• Preferred: CISM - Cert Info Security Manager Issued by Information Systems Audit and Control Association (ISACA).
• Preferred: PMP - Project Mgt Professional Issued by the Project Management Institute (PMI). 
• Preferred: Other applicable security industry certifications. 

The University of Texas MD Anderson Cancer Center offers excellent benefits, including medical, dental, paid time off, retirement, tuition benefits, educational opportunities, and individual and team recognition.

This position may be responsible for maintaining the security and integrity of critical infrastructure, as defined in Section 113.001(2) of the Texas Business and Commerce Code and therefore may require routine reviews and screening. The ability to satisfy and maintain all requirements necessary to ensure the continued security and integrity of such infrastructure is a condition of hire and continued employment.

It is the policy of The University of Texas MD Anderson Cancer Center to provide equal employment opportunity without regard to race, color, religion, age, national origin, sex, gender, sexual orientation, gender identity/expression, disability, protected veteran status, genetic information, or any other basis protected by institutional policy or by federal, state, or local laws unless such distinction is required by law.http://www.mdanderson.org/about-us/legal-and-policy/legal-statements/eeo-affirmative-action.html