IT Security Analyst (5353C), Information Security Office #87490

At the University of California, Berkeley, we are dedicated to fostering a community where everyone feels welcome and can thrive. Our culture of openness, freedom, and belonging makes it a special place for students, faculty, and staff, who are among the most talented and accomplished anywhere, including Nobel laureates, Pulitzer Prize winners, and MacArthur Fellows. Since our founding in 1868, we have been an engine for innovation - driving intellectual, economic, and social progress that benefits California, the U.S., and beyond. Together, we change the world.

At Berkeley, the best careers are built on a foundation of continuous learning and growth. We actively support professional development by providing all full-time staff employees with at least 80 hours of paid time per year and provide space for supportive colleague communities via numerous employee resource groups.

We invite applicants who are inspired by our Principles of Community and who are eager to be part of our exciting Strategic Plan, which charts Berkeley's next era of excellence.

Learn more about some of our accomplishments at Points of Pride.

Departmental Overview

The Information Security Office (ISO) coordinates the risk management process for UC Berkeley's information systems and directs campus-wide efforts to adequately secure institutional data. ISO is led by the Chief Information Security Officer and consists of seven areas: Information Security Policy, Information Security Operations, Information Security Administration and Engineering, Identity and Access Management, Information Security Assessments, Outreach and Engagement, and Service Management.

Position Summary

As a seasoned IT Security Analyst working collaboratively within the Security Engineering team at UC Berkeley, the candidate will focus on systems administration, managing Security Engineering systems, including installation, configuration, and patching of systems and software, while implementing security controls according to best practices to prevent malicious intrusion of systems.

The candidate will research and implement systems, services, and technology solutions to support Information Security Office systems and services, writing and executing complex scripts in support of systems management, log analysis, and other system administration duties for multiple integrated systems. Additionally, the candidate will assist in implementing and maintaining various DevOps processes to automate systems provisioning and management.

The role involves implementing complex and broad-scale security controls to prevent unauthorized access or changes to campus hardware, software, and network infrastructure, including systems such as Firewalls, TAPs, intrusion detection/prevention systems (IDS/IPS), Endpoint Detection and Remediation (EDR agents), Vulnerability Scanners, and the Security Information and Event Management system (SIEM). The candidate will provide research, analysis, and solutions to address attempted efforts to compromise security protocols, advise the campus community on security prevention, best practices, and secure software, and serve as a subject matter expert, providing analysis and context for security investigations and incidents.

Application Review Date

The First Review Date for this job is August 7, 2026. For full consideration, please apply on or before the first review date.

Responsibilities

30%

• Manages Information Security Office systems, including the installation, configuration, maintenance, and support of systems and software.
• Implements security controls according to best practices to prevent malicious intrusion of systems.

30%

• Researches, evaluates, and implements systems, services, and technology solutions that support Information Security Office systems and services.
• Performs system or device enhancements such as software, hardware, and network configuration, updates and installations for projects or services of moderately complex scope.

15%

• Writes and executes complex scripts in support of systems management, log analysis and other duties for multiple integrated systems.
• Assist in implementing and maintaining various DevOps processes to automate systems provisioning and management.

10%

• Implements complex and broad-scale security controls to prevent and detect unauthorized access or changes to campus hardware, software, and network infrastructure. Systems such as FireWalls, Intrusion Detection/Prevention Systems(IDS/IPS), Endpoint Detection and Remediation (EDR agents), Vulnerability Scanners, and Security Information and Event Management systems (SIEM).
• Responsible for providing research, analysis and solutions to address attempted efforts to compromise security protocols.
• Advises the campus community on security prevention, best practices and secure software.

5%

• Serves as a subject matter expert, providing analysis and context for security investigations and incidents.

5%

• Triages security incidents and support tickets as part of a periodic analyst rotation; may participate in responding to security events and operational issues that may require immediate attention and arise during and/or outside of standard hours of operations, including evenings, weekends, and holidays.

5%

• Participates in professional development and training activities to maintain expertise in information security, security engineering, and related technologies.
• Stays current with evolving threats, tools, and industry best practices, contributes to team knowledge sharing and documentation efforts, and performs other duties as assigned.

Required Qualifications

• Experience reading and interpreting logs from a broad range of applications and services used in enterprise IT, with a focus on security relevant logs.
• Ability to follow and/or ability to learn department processes and procedures.
• Interpersonal skills sufficient to work effectively with both technical and non-technical personnel at various levels in the organization.
• Experience using IT security systems and tools, such as Intrusion Detection Systems, Vulnerability Scanners, Firewalls, Security Information and Event Management systems.
• Advanced knowledge of computer security best practices and policies including demonstrated experience securing server-based software.
• Demonstrated skill at administering complex security controls and configurations to computer hardware, software and networks.
• Knowledge of computer hardware, software and network security issues and approaches.
• Experience with Linux systems, particularly Redhat Enterprise Linux.
• Familiarity with web servers, load balancers, firewalls, and DNS.
• Ability to write technical documentation in a clear and concise manner.
• Understanding of system performance monitoring and actions that can be taken to improve or correct performance.
• General knowledge of other areas of IT.
• Thorough understanding of and experience with systems and security issues and corrective actions.
• Experience automating systems build and provisioning using tools such as Ansible and Terraform.

Preferred Qualifications

• Experience in incident response and digital forensics including data collection, examination and analysis.
• Experience designing, deploying, and maintaining distributed systems, particularly Kafka and Elasticsearch.
• Experience deploying containerized systems in a production environment.
• Ability to read and write code in one or more of the following: Ruby, Python, Go.
• Experience with the Elastic ecosystem, particularly Logstash, Kibana, and Elastic Security.

Education / Training

• Bachelor's degree in related area and / or equivalent experience / training. (Required)

Salary & Benefits

For information on the comprehensive benefits package offered by the University, please visit the University of California's Compensation & Benefits website.

Under California law, the University of California, Berkeley is required to provide a reasonable estimate of the compensation range for this role and should not offer a salary outside of the range posted in this job announcement. This range takes into account the wide range of factors that are considered in making compensation decisions, including but not limited to experience, skills, knowledge, abilities, education, licensure and certifications, analysis of internal equity, and other business and organizational needs. It is not typical for an individual to be offered a salary at or near the top of the range for a position. Salary offers are determined based on final candidate qualifications and experience.

The budgeted annual salary range that the University reasonably expects to pay for this position is $91,500.00 - $120,000.00.

• This is an exempt, monthly-paid position.
• This is a full-time (40 hours/week) Career position eligible for UC benefits.

How to Apply

To apply, please submit your resume and cover letter.

Other Information

• This is not a visa opportunity. This position does not include sponsorship of a new consular H-1B visa petition that would require payment of the $100,000 supplemental fee.
• This position is governed by the terms and conditions in the agreement for the Technical Unit (TX) between the University of California and the University Professional and Technical Employees (UPTE). The current bargaining agreement manual can be found at: http://ucnet.universityofcalifornia.edu/labor/bargaining-units/tx/index.html

Conviction History Background

This is a designated position requiring fingerprinting and a background check due to the nature of the job responsibilities. Berkeley does hire people with conviction histories and reviews information received in the context of the job responsibilities. The University reserves the right to make employment contingent upon successful completion of the background check.

Misconduct

As a condition of employment, the final candidate who accepts a conditional offer of employment will be required to disclose if they have been subject to any final administrative or judicial decisions within the last seven years determining that they committed any misconduct; received notice of any allegations or are currently the subject of any administrative or disciplinary proceedings involving misconduct; have left a position after receiving notice of allegations or while under investigation in an administrative or disciplinary proceeding involving misconduct; or have filed an appeal of a finding of misconduct with a previous employer.

"Misconduct" means any violation of the policies or laws governing conduct at the applicant's previous place of employment, including, but not limited to, violations of policies or laws prohibiting sexual harassment, sexual assault, or other forms of harassment, discrimination, dishonesty, or unethical conduct, as defined by the employer. For reference, below are UC's policies addressing some forms of misconduct:

UC Sexual Violence and Sexual Harassment Policy

UC Anti-Discrimination Policy

Abusive Conduct in the Workplace

Equal Employment Opportunity

The University of California is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, age, protected veteran status, or other protected status under state or federal law.