Associate Information Compliance Officer

Ensure the safety of information systems assets and protect systems from intentional or inadvertent access; accidental or unauthorized modification, destruction, or disclosure: and meet emergency data processing needs.

PLEASE NOTE:

This is a one-year fixed-term role.

At Stanford, we are committed to creating meaning, solving complex challenges, and enriching lives on a global scale. We are currently seeking a talented Information Security Officer to play a vital role in our dynamic and close-knit team within the Information Security Office. In this essential position, you will lead initiatives to protect our digital resources, developing and implementing innovative security strategies to effectively mitigate risks.

Your expertise will contribute to our mission of maintaining a secure and resilient environment for education, research, and healthcare.

The Information Security Office is a high-profile team, and is one of the few departments with university-wide purview, so you'll have plenty of opportunity to share and shine. We operate with a high degree of autonomy, expecting each of our contributors to bring their own special talents to bear on the tough challenges facing the university.

The Cybersecurity Governance, Risk, and Compliance (GRC) team within the Information Security Office is an innovative, newly-formed team with an entrepreneurial spirit, and we invite you to help us grow while advancing your own career.

In this role, you will support the research community by providing support and guidance on information security matters. You will collaborate with local Stanford IT groups and Stanford Research Computing to help implement and improve security measures that meet NIST 800-171 standards.

Your main responsibilities will include helping to execute a strategy that prepares the university for an increasing number of security audits and changing regulatory requirements, particularly focusing on the Cybersecurity Maturity Model Certification (CMMC) and NIST 800-171 standards. This will involve helping to assess the university's current security practices and identifying any gaps that could affect compliance.

You will assist in implementing best practices and guidelines to strengthen cybersecurity measures and support audit preparations.

You will also play a key role in maintaining an awareness and training program aligned with NIST to educate the organization to foster a culture of security awareness and responsibility.

Typical Activities:

Assist in the preparation and implementation of the NIST readiness project, ensuring alignment with NIST frameworks and guidelines to improve the organizationʼs security posture.

Collaborate in developing and executing a comprehensive strategy to prepare the university for security audits and regulatory requirements, with a particular focus on the Cybersecurity Maturity Model Certification (CMMC).

Support the assessment and implementation of security controls in accordance with NIST standards, assisting in identifying gaps and recommending corrective actions.

Develop and deliver an awareness and training program aligned with NIST to educate the organization.

Collaborate in the review and update of security policies and procedures to ensure they meet NIST requirements and reflect best practices in cybersecurity.

Support the monitoring of security controls and risk management practices, regularly evaluating the effectiveness of existing security measures.

Help prepare and maintain documentation related to security policies, procedures, and compliance efforts, including risk assessments and operational reports.

Collaborate with cross-functional teams, including IT, Finance, Human Resources, and Legal, to integrate information security into the organization's overall risk management program.

Keep abreast of industry trends, emerging threats, and evolving regulatory requirements to inform security practices and compliance strategies.

Perform any other related duties assigned to support the organization's information security program.

Remote Work:

This position is eligible for remote work, but keep the following in mind: our team operates on Pacific Time, and we adjust salary based on regions of the country. You may be expected to come to campus, but generally expect that to be no more than a few days each quarter. Weʼll pay for your travel if youʼre outside the greater Bay Area. See our admin guide for more information.

Responsibilities

• Core Duties: Develop procedures to safeguard computer configurations against accidental or unauthorized modification, destruction, or disclosure and to meet the data standards.
• Perform system security reviews and tests and write formal reports and follow up advisory memos.
• Receive reports on security breaches and risks, take appropriate action, and recommend solutions to minimize harm and liability.
• Monitor process and inspect system and network data for computer and network usage policy compliance, system integrity, and incident response. Interface with Information Security Office to report incidents.
• Participate in the development and documentation of information security standards, best practices and guidelines by drafting policies, standards and procedures. Deliver educational information and develop awareness for  system administrators and user community.
• Provide guidance in the design of secure system and network architectures.
• Evaluate new applications to comply with enterprise security standard.  Recommend and implement solutions identified through organizational security audits.
• Network with information security members from other communities.
• Translate technical information to users of various knowledge levels at outreach events such as presentations and meetings.
• Minimum Education and Experience: Bachelor’s degree plus three years relevant experience, or a combination of education and relevant experience.
• Knowledge, Skills and Abilities: Demonstrated knowledge and understanding of IT security trends and emerging technologies and an ability to relate them to Stanford and its objectives.
• Thorough and demonstrated knowledge of networking protocols, principles, and intrusion detection devices, including firewalls and
• VPNs.
• Fundamental architecture and configuration knowledge of desktop server and operating systems.
• Solid understanding of security issues, techniques, and solutions.
• Strong experience with debugging, troubleshooting, forensics and security utilities.
• Basic understanding of scripting language.
• In-depth knowledge of authentication protocols, encryption and other fundamental security technologies.
• Excellent written and verbal communication skills.
• High level of integrity and excellence judgment concerning proprietary and privacy issues.