Principal Cybersecurity Analyst - Risk Mgmt & AI Security

The University of Texas MD Anderson Cancer Center is a mission-driven healthcare organization seeking a Principal Cybersecurity Analyst. The role provides strategic and architectural leadership for enterprise governance, risk, and compliance programs, cybersecurity risk management, platform integration, regulatory compliance, and emerging AI security governance initiatives. The position also advises executives, leads risk assessments, develops roadmaps, and mentors cybersecurity teams.

Responsibilities:

• Serve as principal architect and subject matter expert for enterprise GRC and cybersecurity risk programs
• Define and maintain risk assessment methodologies, control frameworks, and risk scoring models
• Establish workflows across development, staging, and production environments
• Develop SOPs, roles, segregation of duties, and change management processes
• Lead design and execution of enterprise risk management strategies
• Architect and maintain integrations across Archer, Tenable, ServiceNow, Microsoft Configuration Manager (SCCM/MECM), and Medigate
• Design automated workflows consolidating asset, vulnerability, and risk data
• Enable enterprise-wide risk visibility and reporting through data-driven systems
• Ensure data quality, reconciliation, and interoperability across platforms and CMDB
• Apply frameworks including NIST CSF, NIST 800-53, HIPAA, and HITRUST
• Conduct control mapping, gap assessments, and compliance reporting
• Advise stakeholders on remediation strategies and regulatory requirements
• Align institutional policies with regulatory and accreditation standards
• Establish and mature AI security and governance programs
• Develop AI risk assessment criteria and governance standards
• Align controls to NIST AI Risk Management Framework and institutional policies
• Evaluate AI/ML tools and vendors for data protection and compliance risks
• Partner with data governance, privacy, and legal teams on AI initiatives
• Develop multi-year roadmaps, milestones, and resource plans
• Lead enterprise and project-level risk assessments
• Translate technical findings into executive-level reporting and dashboards
• Advise leadership on risk posture and investment prioritization
• Provide technical leadership and mentorship across teams

Requirements:

• • Required: Bachelor's Degree Computer Information Systems, Business Information Systems, Computer Science or related field
• • Required: 7 years In information security and/or cybersecurity experience including multiple security domains, to include two years lead/supervisory experience
• • May substitute required education degree with additional years of equivalent experience on a one to one basis
• • Preferred: Master's Degree Information Security, Computer Science or related field
• • Preferred: At least 7–8 years of progressive cybersecurity experience, hands-on risk management (risk assessment, risk register ownership, control evaluation, or risk quantification), led or owned a security risk management program or framework implementation (e.g., NIST RMF/CSF, ISO 27005, FAIR, or equivalent), direct hands-on experience assessing the security or risk posture of AI/ML systems or GenAI deployments, ability to translate technical risk into business-level language for executive and governance audiences (e.g., briefing a CISO, risk committee, or board), experience using Archer, excellent communication skills, risk management, and cybersecurity framework is a must
• • Preferred: CISSP - Cert IS Security Professional Issued by the International Information Systems Security Certification Consortium ((ISC)
• • Preferred: CISM - Cert Info Security Manager Issued by Information Systems Audit and Control Association (ISACA)
• • Preferred: PMP - Project Mgt Professional Issued by the Project Management Institute (PMI)
• • Preferred: Other applicable security industry certifications