Senior Information Assurance Analyst - Security Architecture / Vulnerability Management

We recognize our competitive advantage -- our people. We believe in our people, who share our vision of meeting the needs of our employees, customers, and communities and who carry out the continued success of the company.

 

Our employees are committed to the company's foundational values: integrity, excellence, teamwork, environmental stewardship, and community commitment. In turn, we invest in our employees, providing opportunities for challenge and advancement and offering a competitive compensation package.

 

Posting End Date:  at 11:59PM HST

 

BRIEF POSTING DESCRIPTION:

The P EJ INFORMATION ASSURANCE Department of the P INFORMATION ASSURANCE Division at Hawaiian Electric Company has 3 Management vacancies available. (Role: PROFESSIONAL)

 

 

JOB FUNCTION (Security Architecture):

• Reports directly to the Information Assurance Manager.  Serves as a mentor to others in the department on Information Security Architecture reviews and risk and control assessments, including the development of detailed plans and requirements for information systems’ security controls and security monitoring solutions.
• Provides consulting-level knowledge and expertise for the Information Assurance (IA) department functions, which includes development of information security policies & standards, information risk management, information technology (IT) and operational technology (OT) compliance, and secure integration of grid technologies and cloud services.
• Coordinates ongoing compliance reviews with Process Area representatives
• Assists in developing practices and procedures to ensure that cost-effective information security and IT controls are in place.

 

JOB FUNCTION (Vulnerability Management):

• Reports directly to the Information Assurance Manager.  Serves as a mentor to others in the department on Vulnerability Management, including program development, coordination, and reporting.
• Provides consulting-level knowledge and expertise for the Information Assurance (IA) department functions, which includes development of information security policies & standards, information risk management, information technology (IT) and operational technology (OT) compliance, and secure integration of smart grid technologies.
• Coordinates ongoing compliance reviews with Process Area representatives
• Assists in developing practices and procedures to ensure that cost-effective information security and IT controls are in place.

 

ESSENTIAL FUNCTIONS:

• Supports information security risk assessments and recommends mitigating controls and solutions for IT and OT projects and applications, including proposals for externally hosted applications and new utility technology projects.
• Assists with program development and management for privacy, e-discovery, security awareness training, digital forensics, patch management, vulnerability remediation, and other security and compliance programs.
• Supports the detailed review and approval processing for various IT policies, processes, and procedures necessary to support the Company’s information security and compliance requirements. 
• Ensures that adequate and proper internal controls and CobiT framework-based IT policies, processes, practices, and standards are developed, maintained, and tested for quality assurance in order to meet the Company’s Sarbanes-Oxley (SOX), Privacy and other compliance needs.
• Supports the IT business continuity planning, IT disaster recovery planning, and the Company’s Computer Security Incident Response Team (CSIRT).

• Participates in Company emergency response activities as assigned, including any activities required to prepare for such emergency response.

 

BASIC QUALIFICATIONS:

Knowledge Requirements

• Computer networking concepts and protocols, and network security methodologies.
• Risk management processes (e.g., methods for assessing and mitigating risk).
• Cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
• Cyber threats and vulnerabilities.
• Cryptography and cryptographic key management concepts.
• Data backup and recovery concepts.
• Host/network access control mechanisms (e.g., access control list, capabilities list).
• Network access, identity, and access management (e.g., public key infrastructure, Oauth, OpenID, SAML, SPML).
• Traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI