Senior Cybersecurity Analyst, OT Compliance

Marathon Petroleum Corporation•Findlay, OH

10h•Onsite

About The Position

The Senior Cybersecurity Analyst, OT Compliance is responsible for leading cybersecurity compliance, governance, and risk management activities across Operational Technology (OT) environments. This role ensures compliance with corporate cybersecurity standards, regulatory requirements, and industry frameworks while supporting the secure and reliable operation of industrial control systems, process control networks, and critical infrastructure assets. The position serves as a subject matter expert on OT cybersecurity compliance and works closely with Operations, Engineering, Digital, Audit, and Cybersecurity teams to assess security controls, conduct compliance evaluations, manage remediation efforts, and support audit readiness activities. The Senior Cybersecurity Analyst drives continuous improvement initiatives by identifying compliance gaps, coordinating corrective actions, and monitoring the implementation of OT security requirements aligned with applicable standards and regulations. This role provides guidance on cybersecurity risks, control effectiveness, and regulatory obligations while supporting enterprise initiatives related to governance, asset inventory, identity access management, and security monitoring within OT environments. The position plays a critical role in maintaining a resilient and compliant cybersecurity posture that protects operational assets, ensures regulatory compliance, and supports safe and reliable business operations. This position belongs to a family of jobs with increasing responsibility, competency, and skill level. Actual position title and pay grade will be based on the selected candidate’s experience and qualifications.

Requirements

Bachelor’s degree in information technology, related field or equivalent experience.
5+ years of relevant experience required.
Adaptability - Maintaining effectiveness when experiencing major changes in work responsibilities or environment (e.g., people, processes, structure, or culture); adjusting effectively to change by exploring the benefits, trying new approaches, and collaborating with others to make the change successful.
AI Fundamentals - Understanding of core AI concepts and methods, ability to apply AI to job-relevant use cases and capacity to contribute to organizational AI reimagination.
Change Management - Change Management refers to a systematic approach for defining and implementing procedures and/or technologies to deal with changes in the environment. It can mean adapting to change, controlling change and/or effecting change.
Authentic Communicator -Expresses ideas and information, both verbally and in writing, clearly and credibly. Listens to understand and fosters constructive dialogue.
Cybersecurity Risk Management - The process of developing cyber risk assessment and treatment techniques that can effectively pre-empt and identify significant security loopholes and weaknesses, demonstrating the business risks associated with these loopholes and providing risk treatment and prioritization strategies to effectively address the cyber-related risks, threats and vulnerabilities, ensuring appropriate levels of protection, confidentiality, integrity and privacy in alignment with the security framework.
General Programming - Applies a computer language to communicate with computers using a set of instructions and to automate the execution of tasks.
Intrusion Detection - The use of security analytics, including the outputs from intelligence analysis, predictive research and root cause analysis in order to search for and detect potential breaches or identify recognized indicators and warnings. Also, monitoring and collating external vulnerability reports for organizational relevance, ensuring that relevant vulnerabilities are rectified through formal change processes.
Penetration Testing - The practice of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. Penetration testing can be automated with software applications or performed manually.
Relationship Management - Relationship Management is the conscious aim to develop and manage long-term and/or trusting relationships with internal or external customers, distributors, suppliers, or other parties in an environment which can include marketing, selling, servicing and other areas where a relationship is crucial to on-going success. At a senior level, it includes C-level relationships with senior management.
Security Controls - Manages and maintains an information system that focus on the management of risk and the management of information systems security.
Security Governance - The process of developing and disseminating corporate security policies, frameworks and guidelines to ensure that day-to-day business operations are guarded and well protected against risks, threats and vulnerabilities.
Security Information & Event Management (SIEM) - A set of tools and services offering real-time visibility across an organization's information security systems, and event log management that consolidates data from numerous sources.
Security Policy Management - The process of identifying, implementing, and managing the rules and procedures that all individuals must follow when accessing and using an organization's IT assets and resources.
Threat Analysis - Monitor intelligence-gathering and anticipate potential threats to an IT/OT systems proactively. This involves the pre-emptive analysis of potential perpetrators, anomalous activities and evidence-based knowledge and inferences on perpetrators' motivations and tactics.
Threat Hunting - Searches through networks, endpoints, and datasets to detect and isolate cyber threats that evade existing security solutions.
Vulnerability Management - The process of defining, identifying, classifying and prioritizing vulnerabilities in computer systems, applications and network infrastructures and providing the organization with the necessary knowledge, awareness and risk background to understand the threats to its business.

Nice To Haves

Professional certification, e.g. Security+, Network+, OSCP, GIAC, CEH, CISA, CISM CISSP preferred.

Responsibilities

Conducts detailed analyses on controls related to complex business processes and systems and relationship to other internal and external systems to assess business impact of the security issues.
Drives the resolution of routine multi-functional technical issues.
Oversees, advises on and manages Cybersecurity assessments and associated risks.
Develops and evaluates efficiency and effectiveness of security processes and controls through creation and maintenance of detailed security and/or compliance reports, as necessary.
Support user access certification and attestation programs by collecting and validating evidence, facilitating reviewer approvals, resolving exceptions, and maintaining documentation to support audit and compliance activities.
Drive continuous improvement of OT cybersecurity compliance processes, tools, and controls to enhance regulatory compliance, audit readiness, and risk management.
Analyzes and maintains security audits and reports, monitors security advisory groups, and assist with security incidents and intrusions.
Support regulatory inspections, internal audits and external audits through evidence management, coordination activities, and issue resolution.
Performs Incident Detection, Analysis, Response Planning, Containment, Eradication, Forensics and Reporting.
Assists in the development of innovative and creative ideas to formulate risk mitigation and remediation plans and approaches to ensure compliance.
Leads implementation of global security initiatives, policies, and compliance requirements.
Develops and tracks metrics related to cybersecurity; use existing cybersecurity tools for running web application scanning, vulnerability scanning and external pentests and help with the remediation effort.
Lead cybersecurity activities supporting SOX audits, including control testing coordination, evidence management, auditor engagement, issue resolution, and remediation tracking to ensure timely and successful audit outcomes.
Manages cyber security-related consulting, guidance, and support to customers and stakeholders.
Translates security principles to assist configuration teams with incorporating security into build and configuration processes.
Monitors emerging Information Technology/Operations Technology and cybersecurity technologies as well as their impact on the security landscape.