Information Security Risk Analyst II

Southern New Hampshire University is a team of innovators. World changers. Individuals who believe in progress with purpose. Since 1932, our people-centered strategy has defined us — and helped us grow a team that now serves over 180,000 learners worldwide.

Our mission to transform lives is made possible by talented people who bring diverse industry experience, backgrounds and skills to the university. And today, we're ready to expand our reach. All we need is you.
Make an impact — from near or far

At SNHU, you'll have the option to work remotely in the following states: Alabama, Arizona, Arkansas, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, New Hampshire, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin and Wyoming.

We ask that our remote employees have access to a reliable internet connection and a dedicated, properly equipped workspace that is free of distractions. Employees must reside in, and work from, one of the above approved states.
The opportunity

The Information Security Risk Analyst supports the identification, assessment, and monitoring of information security and privacy-related risks to help safeguard the University's systems, data, and operations. This role contributes to SNHU's information security risk management program through the application of qualitative and quantitative evaluation of threats, vulnerabilities, and security control effectiveness across systems, vendors, technologies, and business processes.

The Analyst performs risk analyses, maintains accurate risk records within the GRC platform, supports vulnerability and remediation tracking, participates in risk assessments, and contributes to risk reporting and program improvement activities. This role works collaboratively within the Governance, Risk, and Compliance (GRC) function, partnering with information security, compliance, audit, privacy, and business stakeholders to ensure risk management activities align with regulatory requirements, institutional policies, organizational priorities, and industry best practices. You will report to the Senior Manager of Information Security Risk and Compliance.
Primary Duties and Responsibilities:

- Conduct qualitative and quantitative information security risk assessments across systems, vendors, technologies, and business processes to identify threats, vulnerabilities, and control gaps affecting the University's information security risk posture.

- Maintain accurate risk records, artifacts, and supporting documentation within the University's GRC platform to ensure consistency, quality, and compliance with established risk management processes.

- Collaborate with information security, privacy, compliance, audit, and business stakeholders to coordinate and document risk mitigation activities and track remediation efforts in alignment with regulatory requirements, risk management frameworks, institutional policies, and organizational priorities.

- Analyze and monitor security risks and prepare risk metrics and reports that support ongoing risk visibility and decision-making.

- Assist in the development, implementation, and continuous improvement of information security risk management and compliance policies, standards, procedures, and operating models that strengthen the University's security and privacy posture.

- Collaborate with GRC leaders to support risk awareness and education initiatives through the identification of key human and organizational risk drivers and the promotion of risk-informed behaviors required to mitigate them.

- Monitor changes in cybersecurity threats, regulatory requirements, and industry best practices, and apply relevant knowledge to support the ongoing effectiveness and maturity of the University's information security risk management prog