Operational Technology Security Compliance Analyst

Title: Operational Technology Security Compliance Analyst  
Company: Peoples Gas System
State and City: Florida   -  Tampa
Shift: 8 Hr. X 5 Days

WHAT YOU’LL DO

Responsible for supporting activities directly related to the company’s Operational Technology Critical Infrastructure security and compliance programs. This includes ensuring that all processes and procedures are followed on a daily, weekly, monthly, and annual basis. Additionally, provides expert level support, within the immediate team and larger cross functional organizational team environment, for systems used to monitor and protect operational assets. The scope includes Field OT Devices and Equipment, (Programable Logic Controllers, Industrial Controls, RTU, Communication Devices, Transient Cyber Assets and HMI).

Operational Technology Security Compliance Analyst develops and possess an in-depth understanding of the DHS, TSA, Purdue ICS Security Model, IEC 62443 (ISA 99) standards and requirements, resolving issues by taking the appropriate corrective action, or following the appropriate escalation procedures. The responsibilities include assessing all Peoples Gas System Field assets for secure configurations and performing routine monitoring to identify potential non-compliance issues.

Day-to-Day Responsibilities:

• Assist in translating the ICS standards and requirements into the appropriate systemic and procedural solutions to enable compliance adherence. Assist coordinating and communicating necessary actions to maintain regulatory compliance.
• Collect, organize and maintain required evidence for regulatory compliance, such as network diagrams, access controls, ports and services, physical port security, malicious code prevention, firmware and patches, security event monitoring, account management, and baseline components.
• Assist in the development of tools and reports for efficient, sustained, and organized evidence collection and reporting for regulatory compliance, such as ICS network diagrams, access controls, ports and services, physical port security, malicious code prevention, firmware and patch testing, security event monitoring, account management, and baseline components.
• Assist in the development and enforcement of company policies, procedures, processes, plans, and standards that support and facilitate regulatory compliance. This entails assisting in populating and updating asset inventory and management software, process documents, desk, lab and field level procedures, overseeing deployment and disaster recovery plans, and other supporting evidence as demand and necessity arise.
• Assist in documenting management responses to internal/external regulatory audits and data requests in conjunction with respective management and staff

What We’re Looking For

Must Haves:  

• Bachelor’s Degree in Control Systems Engineering, Computer Science, Information Systems, or other SCADA or process control related discipline AND two (2) years of related cyber security, IT, industrial control systems, or NERC CIP experience OR a valid High School Diploma and six (6) years of related cyber security, IT, industrial control systems, or NERC CIP experience. 
• Ability to obtain one related IT Security professional certification from the following list of certification vendors, or via self-study within one year of hire date: ISA/IEC 62443, CISSP, CISM, CISA, CSX-P, GIAC, CompTIA, GICSP (Global Industrial Control Systems), or similar. 
• Must demonstrate basic functional knowledge and proficiency of Industrial Controls and Natural Gas Operations related functions outlined in the Duties and Responsibilities of this position, and applicable equipment and operational systems to ensure efficiencies and field related data accuracy/integrity for the company.
• Must demonstrate working knowledge of the general compliance processes that ensure good foundation for compliance like 49 CFR DOT 192 PHMSA, NERC CIP and other regulatory or industry standards and requirements. Analytical and risk assessment skills as well as strong listening, written and computer communication skills for reporting and auditing purposes.
• Basic understanding and working knowledge of major security systems and functions: Password Management Solutions, Firewalls, Antivirus/Antimalware, SIEM (Syslog), Incident Response, Threat and Configuration and Change tools and processes. Familiar knowledge of major industrial control systems) operating systems and applications (Emerson, Honeywell, Eagle, Rockwell, ABB, AEC, Schneider, AVEVA, FlowCal, Highwire, GE RTU, PLC, and Windows)

Nice-to-Haves:

• Master’s Degree in Computer Science, Information Systems, or other IT related discipline. One year of experience in diverse Industrial Control environment.
• Two or more of the following or similar IT Security professional certifications: CISSP, CISM, CISA, CSX-P, GIAC, CompTIA, GICSP (Global Industrial Control Systems), or similar.
• Working knowledge and proficiency of Natural Gas Automation and Operations related functions outlined in the Duties and Responsibilities of this position, and applicable SCADA and OT systems to ensure operational efficiencies and related data accuracy/integrity for the company. Working Knowledge in TSA, DOT, PHMSA, NERC – CIP compliance
• Understanding of major security systems and functions: Password Management Solutions, Patch and Firmware Testing and Documentation, Firewalls, IDS/IPS, Antivirus/Antimalware, SIEM (Syslog), Incident Response, Threat and Configuration and Change tools and processes.

Competencies:

Takes Ownership and Acts with Integrity

Drives Operational Excellence for Customers

Builds Strong, Collaborative Relationships

Cultivates Innovation and Embraces Change

Thinks Strategically and Exercises Sound Judgement

#LI-CC1