Security Analyst I

Summit Utilities Inc • Fort Smith, AR

1d • Hybrid

About The Position

The Security Analyst I protects Summit Utilities' business systems, operational technology (OT), and data by monitoring for threats, investigating and responding to security events, and owning assigned security control areas from start to finish. The role spans the corporate IT environment and the Industrial Control Systems (ICS) and SCADA environment supporting Summit's natural gas distribution system, working closely with IT, SCADA, and Gas Control teams to keep operations safe, reliable, and secure.

Reporting to the Director of Information Security, this independent contributor leads Tier-2 investigations, tunes detections, drives vulnerability remediation with system owners, and prepares evidence for audits and assessments aligned to TSA Pipeline Security Directives, C2M2, NIST CSF, and NERC CIP. The role also supports security awareness through training, interactive exercises, and clear communication throughout the organization. This is a hybrid position based in the Little Rock, Fort Smith, or Fayetteville, Arkansas offices.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Computer Information Systems, Information Technology, or a closely related field; equivalent experience, including OT Security industry experience, may be considered in lieu of a degree.
• 2–5 years of experience in security operations or a related IT role.
• Solid knowledge of information security principles and best practices, networking design and protocols, and cryptographic communication and storage protocols.
• Proficiency with log and event analysis, including writing SIEM queries and correlation rules and investigating across multiple data sources.
• Experience with packet capture analysis, investigation protocols, and discovery techniques.
• Working knowledge of endpoint detection and response (EDR), next-generation firewall, and proxy security controls, including configuration and tuning.
• Experience with vulnerability scanning, penetration testing and mapping tools, and system hardening.
• Working knowledge of OT assets and industrial protocols such as Modbus, DNP3, EtherNet/IP, and OPC; the Purdue model; and how safety and availability priorities in OT differ from IT.
• Familiarity with security and governance frameworks such as NIST CSF, NIST SP 800-82, ISA/IEC 62443, C2M2, TSA Pipeline Security Directives, NERC CIP, and CIS Controls.
• Understanding of identity and access management concepts, including MFA, SSO, least privilege, and privileged access.
• Working knowledge of cloud security controls, logging, and the shared responsibility model.
• Decisiveness, sound judgment under pressure, and a clear sense of when to escalate.
• Strong written and verbal communication skills, including the ability to explain security requirements and risks to field personnel and leadership.
• Ability to collaborate across IT, OT, and business teams, manage multiple priorities, and meet deadlines.

Nice To Haves

• Exposure to OT/ICS security.
• Experience with SCADA or control system operations or communications in the natural gas, pipeline, or power industry.
• CompTIA Security+, CySA+, GIAC GCIH, or GSEC certification.
• Global Industrial Cyber Security Professional (GICSP) certification.
• Scripting ability in PowerShell or Python.

Responsibilities

• Monitor security alerts and log data across IT and OT environments; investigate suspicious activity and respond to Tier-2 security events from triage through resolution.
• Document, classify, and track security events and incidents; draft incident reports and escalate major incidents and events affecting OT operations according to the incident response plan.
• Write and tune detection queries and correlation rules to improve alert quality and reduce false positives.
• Perform forensic analysis and evidence collection on suspicious devices; conduct legal hold actions and investigations when required.
• Apply threat intelligence from sources such as CISA and the DNG-ISAC to investigations and detections, mapping activity to MITRE ATT&CK for Enterprise and ICS.
• Coordinate with SCADA Analysts, SCADA Technicians, and Gas Controllers on OT alerts and response, following a safety-first, approval-required approach for response actions in OT environments.
• Review OT network monitoring alerts and support security visibility of control systems, including RTUs, PLCs, and field communication technologies.
• Support hardening, configuration, and testing of security updates for IT and OT systems and servers, aligned to operational change windows and high-availability requirements.
• Run and review vulnerability scans; prioritize findings by risk and asset criticality and partner with IT and OT system owners to remediate and track items to closure.
• Review CVEs and vendor advisories for exposure in IT and OT assets and recommend mitigations or compensating controls.
• Coordinate third-party vulnerability assessments and penetration tests and help develop remediation plans based on findings.
• Conduct security reviews of applications, systems, and integrations before they go live.
• Manage MFA, SSO, and group policy security configurations and run periodic user and privileged access review cycles.
• Prepare control evidence and support control testing for TSA Security Directive alignment, the C2M2 self-assessment, NERC CIP-aligned controls, and internal and external audits.
• Maintain accurate, current documentation for security systems, procedures, and OT security components.
• Participate in tabletop exercises, disaster recovery, and business continuity planning, including scenarios that cross IT and OT.
• Deliver security awareness content and interactive exercises such as phishing simulations, and track completion and effectiveness for all team members.
• Help develop, communicate, and keep current information security policies, standards, and procedures.
• Help newer analysts onboard and pair with them on investigations.
• Serve as a primary member of the security on-call rotation.

Benefits

• Competitive pay.
• Medical insurance.
• Dental insurance.
• Vision insurance.
• Other benefits designed to provide flexibility, choice, and support for employees at work and at home.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level