Information Security Specialist (Industrial Control System)

Information Security Specialist (Industrial Control System) 

Non-Union Position
IS Security & Analytics Staff 1; Portland, Oregon (US-OR)  

Hybrid schedule available for Oregon & Washington residents. 
Regular FT 
Posting # 4767  

 

About Us:

 

At NW Natural, we offer more than rewarding career opportunities and a vibrant, inclusive work culture. We invite you to join us in providing safe and reliable utility services and renewable energy to better the lives of the communities we serve. Our vision is to be the leader in service excellence, innovation and environmental stewardship for our customers, while building on our strengths as a trusted energy provider and environmental leader for our industry.  

 

In addition to environmental stewardship, We’re also deeply committed to Diversity, Equity and Inclusion at NW Natural. Our DEI Council started 21 years ago, and today we continue to foster a culture where all employees can experience a sense of belonging, shared purpose and possibility.
 

The Role:

 

You’ll be a member of the Security Operations Team and collaborate with our teams at plants and in control rooms as we enhance an Industrial Control System (ICS) security program. Your responsibilities would include people, process, and technology. This is a key role in a technology organization maturing its processes and modernizing its technology.

You would understand security in the context of operation priorities and constraints by working closely with Operations staff and translate between operations staff and security team members. To be successful, this role will partner with operations to achieve their goals, not focusing exclusively on security but balancing operational and security needs.

This position will be based at our office in downtown Portland, but you'll also travel to our storage facilities in western Oregon.

 

IT&S Cultural Pillars 

Our Core Values are in everything we do, we expect everyone to embody the Information Technology & Services department’s four cultural pillars…
 
Accountability & Integrity 
We hold ourselves to a high standard and follow through on our commitments.  Our transparency, and ability to deliver on our promises make us a trusted and respected business partner.

Customer Focus 
We understand our customers’ needs and advocate for them.  Our relationship with our customers ensures the technical needs of the business are met.

Growth & Learning 
We embrace new technology and skills to better meet the company’s needs.  Our passion for new technology keeps us ahead of future opportunities for the business.

Respect 
We relate with inclusion, kindness, curiosity, and humility.  Respect for differences leads to innovation and collaboration.

Day to Day:

 

 

Security Consulting:

 

• You (with support from the security team and operations teams) would continue to develop and lead our ICS security program:
• Research, evaluate, design, test, recommend, and plan new or updated security technologies.
• Take operations requirements into account when considering security measures.
• Collaborate on projects with Operational staff and vendors to ensure that security issues are addressed throughout the project lifecycle.
• Review system designs and identify areas for security improvements.
• Provide ad hoc consulting on tactical security topics.
• Develop and revise cybersecurity policies and standards.

 

Vulnerability Management:

 

• Assess and track vulnerabilities in our industrial control systems.
• Work with Operational staff to remediate vulnerabilities. 

 

Security Awareness and Training:

 

• Partner with Operational staff to improve their understanding of the risks associated with security threats to industrial control systems.

 

Security Monitoring and Incident Response:

 

• Review alerts from security monitoring tools (including alerts generated from non-industrial control systems).
• Respond to security incidents including leading the response for smaller incidents.
• Apply NW Natural context to potential incidents to better understand them.
• Liaise between incident response leads and subject matter experts.
• Research and assess new threats and vulnerabilities.
• Develop and report on key performance indicators to show the effectiveness of our ICS security monitoring processes.

 

While the security monitoring and incident response responsibilities mean that there is an afterhours component to this role, typically it is less than one hour pe