Cybersecurity Specialist

NW Natural • Happy Valley, OR

31d • $88,700 - $157,100 • Hybrid

About The Position

The Cybersecurity Specialist joins NW Natural’s Security Operations Team and works on security projects and operational activities, with a focus on vulnerability management. The position supports a technology organization that is maturing its processes and modernizing its technology, and works closely with Network, Cloud, and other technical teams. Its primary purpose is to help ensure the IT&S Department complies with state and federal regulations by identifying, evaluating, prioritizing, monitoring, and reporting on the effectiveness of operational controls across IT and OT environments.

The role also contributes to security consulting, monitoring, and incident response. It evaluates security risks, provides technical guidance, supports security improvements throughout project lifecycles, and communicates solutions and recommendations to colleagues and leadership. The position includes an after-hours component for monitoring and incident response, typically less than one hour per week.

This is a regular full-time, exempt position based at NW Natural’s downtown Portland, Oregon headquarters. Employees work onsite Tuesday through Thursday and may work remotely on Mondays and Fridays, subject to business needs. Candidates must live within commuting distance or be willing to relocate to the Portland metropolitan area. US citizenship is required because the role may involve access to restricted cybersecurity-related information.

Requirements

• At least five years of information security experience; additional experience and demonstrated knowledge or assignment complexity may be required for Level 3.
• Bachelor’s degree in information security, related industry certifications, or an equivalent combination of education and experience.
• ITIL Foundations certification or successful completion within 90 days of starting.
• US citizenship.
• Solid understanding of network and information security priorities, protocols, and concepts.
• Scripting knowledge, such as PowerShell, Python, or Bash.
• In-depth knowledge of information security principles and considerable practical experience.
• Technical knowledge of mainstream Windows and Linux operating systems, complex applications, identity and access management technologies, SIEM, or endpoint security solutions.
• Strong technical written and verbal communication skills, including the ability to explain security concepts to audiences with varying levels of familiarity.
• Leadership ability to direct technical staff on security initiatives and guide team members.
• Ability to work with minimal supervision and analyze security requirements in relation to appropriate security controls.
• Ability to manage expectations and build long-term relationships.
• Ability to remain current with industry trends and evolving threats.

Responsibilities

• Identify vulnerabilities in the company environment using security and endpoint management tools.
• Evaluate and prioritize vulnerabilities; monitor remediation against defined timelines.
• Develop vulnerability reports to identify trends and communicate changes.
• Provide vulnerability management expertise to project and operational teams and implement best practices.
• Validate false positives, manually validate vulnerabilities and remediation, and conduct periodic tool health checks.
• Work with managed service providers on configurations, product and content updates, and security-alert analysis informed by vulnerability management context.
• Develop routine processes and scripts to identify and remediate software-agent issues; troubleshoot vulnerability management tools and their reporting or scanning issues.
• Own remediation tracking and develop and report key performance indicators for vulnerability management processes and the managed service provider.
• Research, evaluate, design, test, recommend, plan, implement, and administer new or updated security technologies.
• Collaborate with staff and vendors to address security issues throughout project lifecycles.
• Review system designs, including cloud and network systems, and identify security improvements.
• Provide ad hoc tactical security consulting and develop or revise cybersecurity policies and standards.
• Review security monitoring alerts and respond to incidents, including leading responses to smaller incidents.
• Apply company context to potential incidents, liaise between incident response leads and subject matter experts, and research and assess threats and vulnerabilities.
• Evaluate security risks and their impact to NW Natural.
• Create technical documentation for analysts and teams; present technical recommendations and issue updates to peers and leadership.
• Train less experienced team members and colleagues.
• Direct other technical staff on security initiatives and guide team members as appropriate.

Benefits

• Health insurance benefits with competitive employer contribution.
• Access to an online wellness resources platform.
• Up to 23 vacation days.
• 80 hours of sick time.
• 10 paid holidays and 3 floating holidays.
• Three weeks of paid parental leave.
• Diversity, Equity & Inclusion Council and Employee Resource Groups.
• On-site exercise facility and secure bike room.
• Annual incentive bonus opportunity.
• 401(k) company contribution and match.
• 15% discount on NW Natural stock through the Employee Stock Purchase Program.
• Up to $5,250 per year in tuition reimbursement.
• Wellness incentive program.
• 20% discount on natural gas service.
• Up to 30% discount at NW Natural Appliance Center.
• TriMet Pass for headquarters employees.
• Discounts with Verizon and AT&T Wireless.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level