Information Security & Compliance Analyst

Las Vegas Valley Water District

9h•Onsite

About The Position

The ideal candidate thrives in a highly collaborative and dynamic enterprise IT environment and brings experience in information security best practices to optimize the effectiveness of District/SNWA cyber security program. Demonstrate strong analytical skills, and the ability to interpret policies, trends, and threat intelligence to anticipate adversary behavior. Using deductive reasoning and problem-solving abilities, they develop effective countermeasures to mitigate cyber threats. Assists in security incidents, understands DevSecOps principles, and collaborates across the organization to guide and support the secure implementation of technology solutions. The candidate is proficient in assessing risk and compliance, with familiarity in third-party risk management. Experience with information security assessments and penetration testing is beneficial. INTRODUCTION: Human Resources will screen applications and supplemental questionnaires. Candidates possessing the strongest skills and experience for this position will be forwarded to the hiring department for further evaluation and to determine who will be invited to the formal interview process. The candidate hired will be required to pass a drug screening, background check and may be required to pass a job-related physical evaluation. GENERAL PURPOSE Under general supervision, performs complex and highly responsible duties in implementing, maintaining, evaluating and enhancing the District/SNWA cyber security protection framework including security architectures, policies, standards and systems to safeguard the integrity and confidentiality of information assets and the availability and reliability of systems operations; participates in activities to ensure compliance with PCI security standards; and performs related duties as assigned.

Requirements

Strong analytical skills
Ability to interpret policies, trends, and threat intelligence to anticipate adversary behavior
Deductive reasoning and problem-solving abilities
Proficiency in assessing risk and compliance
Familiarity in third-party risk management
Knowledge of Principles, practices and methods of cyber-security infrastructure and vulnerability management
Knowledge of Cyber Security and Information Protection and Privacy principles and practices
Knowledge of evolving sources of security threats and vulnerabilities
Knowledge of on-line systems security products and methodologies, applicable to both the enterprise infrastructure and its applications and data management systems
Knowledge of preventative security controls in general industry use including firewalls, IDS/IPS, VPN and others
Knowledge of common security management frameworks such as NIST, SANS Twenty Critical Security Controls and other cyber security standards
Knowledge of PCI compliance requirements and standards
Knowledge of principles, practices and techniques of information technology management
Knowledge of the software development life cycle
Knowledge of operating system architectures, characteristics, components, uses and limitations applicable to the District information technology environment
Knowledge of network architectures and theory and principles of secure network design, integration, configuration and management
Knowledge of principles and methods of enterprise level data management and data storage solutions
Knowledge of troubleshooting principles and practices applicable to areas of responsibility
Knowledge of customer relationship management and internal consulting concepts and practices
Knowledge of systems integration and optimization design concepts and techniques particularly as applicable to areas of assigned responsibility
Knowledge of principles of effective teamwork
Ability to participate in development, administration and enhancement of a comprehensive cyber security protection framework including policies, standards and guidelines
Ability to work collaboratively with other IT units and departments to optimize effectiveness of the District/SNWA cyber security program
Ability to assess specific cyber security requirements, define options, recommend appropriate courses of action, develop cost estimates and procurement packages in support of cyber security management, preventive maintenance and mission critical systems and equipment
Ability to analyze policy, trends, and intelligence to better understand how a cyber security threat actor may think or act, using deductive reasoning and problem solving skills to develop appropriate counter measures
Ability to apply critical thinking skills to isolate problem causes, perform root cause analysis and formulate solutions and workarounds
Ability to analyze cyber security management problems and alternatives, identify potential technical solutions and develop sound conclusions and recommendations
Ability to prepare clear, concise and accurate reports and other materials
Ability to communicate clearly and effectively to diverse audiences of technical and non-technical personnel, orally and in writing
Ability to exercise sound independent judgment within policies, standards and general guidelines
Ability to use tact and diplomacy when dealing with sensitive, complex and/or confidential issues
Ability to establish and maintain highly effective customer-focused working relationships with all levels of management, employees, consultants, contractors, vendors and others encountered in the course of work
Graduation from a four-year college or university with major coursework in computer science, information systems or a closely related field
Five years of progressively responsible professional information technology experience involving network/systems infrastructure administration and security
Certification as a Certified Information Systems Security Professional (CISSP), current CompTIA Security+ certification or comparable certifications with at least four years of comparable experience is required.

Nice To Haves

Experience in a government or public utility setting is highly desirable.
Experience with information security assessments and penetration testing is beneficial.
DevSecOps principles

Responsibilities

Implementing, maintaining, evaluating and enhancing the District/SNWA cyber security protection framework including security architectures, policies, standards and systems to safeguard the integrity and confidentiality of information assets and the availability and reliability of systems operations
Participating in activities to ensure compliance with PCI security standards
Assisting in security incidents
Collaborating across the organization to guide and support the secure implementation of technology solutions
Assessing risk and compliance
Performing information security assessments and penetration testing