Information Security Risk Analyst II

Southern New Hampshire University is a team of innovators. World changers. Individuals who believe in progress with purpose. Since 1932, our people-centered strategy has defined us — and helped us grow a team that now serves over 180,000 learners worldwide.

Our mission to transform lives is made possible by talented people who bring diverse industry experience, backgrounds and skills to the university. And today, we're ready to expand our reach. All we need is you.

Make an impact — from near or far

At SNHU, you'll have the option to work remotely in the following states: Alabama, Arizona, Arkansas, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, New Hampshire, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin and Wyoming.

We ask that our remote employees have access to a reliable internet connection and a dedicated, properly equipped workspace that is free of distractions. Employees must reside in, and work from, one of the above approved states.

The opportunity

The Information Security Risk Analyst supports the identification, assessment, and monitoring of information security and privacy-related risks to help safeguard the University's systems, data, and operations. This role contributes to SNHU's information security risk management program through the application of qualitative and quantitative evaluation of threats, vulnerabilities, and security control effectiveness across systems, vendors, technologies, and business processes.

The Analyst performs risk analyses, maintains accurate risk records within the GRC platform, supports vulnerability and remediation tracking, participates in risk assessments, and contributes to risk reporting and program improvement activities. This role works collaboratively within the Governance, Risk, and Compliance (GRC) function, partnering with information security, compliance, audit, privacy, and business stakeholders to ensure risk management activities align with regulatory requirements, institutional policies, organizational priorities, and industry best practices. You will report to the Senior Manager of Information Security Risk and Compliance.

Primary Duties and Responsibilities:

• Conduct qualitative and quantitative information security risk assessments across systems, vendors, technologies, and business processes to identify threats, vulnerabilities, and control gaps affecting the University's information security risk posture.
• Maintain accurate risk records, artifacts, and supporting documentation within the University's GRC platform to ensure consistency, quality, and compliance with established risk management processes.
• Collaborate with information security, privacy, compliance, audit, and business stakeholders to coordinate and document risk mitigation activities and track remediation efforts in alignment with regulatory requirements, risk management frameworks, institutional policies, and organizational priorities.
• Analyze and monitor security risks and prepare risk metrics and reports that support ongoing risk visibility and decision-making.
• Assist in the development, implementation, and continuous improvement of information security risk management and compliance policies, standards, procedures, and operating models that strengthen the University's security and privacy posture.
• Collaborate with GRC leaders to support risk awareness and education initiatives through the identification of key human and organizational risk drivers and the promotion of risk-informed behaviors required to mitigate them.
• Monitor changes in cybersecurity threats, regulatory requirements, and industry best practices, and apply relevant knowledge to support the ongoing effectiveness and maturity of the University's information security risk management program.
• Other job duties as assigned.

What We're Looking For:

• 3+ years of experience in a related field
• Bachelor's degree
• Experience supporting information security risk management activities for a large enterprise
• Working knowledge of NIST Risk Management Framework (RMF) and other common information security risk management practices and frameworks
• Familiarity with higher education industry standards and regulations (e.g. GLBA, FERPA)
• Experience conducting or supporting risk assessments, tracking remediation activities, and maintaining risk records
• Experience analyzing cybersecurity risks, preparing risk-related documentation and communicating effectively with technical and non-technical stakeholders
• Working knowledge of information security governance, policies, standards, and industry best practices

We believe real innovation comes from inclusion - where different experiences, perspectives and talents are celebrated. So if you're wondering whether SNHU is right for you, take the leap and apply. You might be just the person we're looking for.

Compensation

Exceptional benefits (because you’re exceptional)

You’re the whole package. Your benefits should be, too. As a full-time employee at SNHU, you’ll get:

• High-quality, low-deductible medical insurance

• Low to no-cost dental and vision plans

• 5 weeks of paid time off (plus almost a dozen paid holidays)

• Employer-funded retirement

• Free tuition program

• Parental leave

• Mental health and wellbeing resources