Senior IT Security Analyst

INPO External•Atlanta, GA

About The Position

Summary of Purpose: The Senior IT Security Analyst serves as INPO's primary cybersecurity risk authority, providing oversight and guidance to protect the organization's mission-critical operations in the nuclear power industry. The position, a combination of strategic and hands-on, is responsible for managing and maturing INPO's cybersecurity strategy and program to protect the organization's digital assets and ensure alignment with enterprise risk management objectives, by translating complex technical and regulatory risks into clear actions that reduce risk to INPO. Essential Functions Matures INPO's cybersecurity program, aligning governance, controls, and reporting with NIST Cybersecurity Framework 2.0 and NIST AI Risk Management Framework by setting the standard for security at INPO Refines and maintains IT and security policies, standards, and procedures that operationalize DOE/DOC 810, NRC, and ISO requirements within INPO's compliance environment Maintains the IT risk register and applies assessment and maturity methods to drive consistent identification, analysis, and mitigation tracking across IT Ensures IT integrates risk considerations into technology initiatives, architecture decisions, and change management processes Translates technical risks into executive-level insights that inform prioritization, investment and strategic decisions for the CFO, IT Director, and Senior Leadership Team Produces monthly metrics and quarterly reports on risk posture, trends, maturity, and recommended actions Oversees third-party risk across SaaS, service providers, and supply chain to ensure external relationships meet risk tolerance and contractual/compliance obligations Coordinates IT audits, regulatory examinations, security awareness training, penetration testing, and independent assessments; drives timely remediation and continuous compliance Applies security intelligence from Security Operations Center (SOC)/Managed Detection and Response (MDR) vendors to inform actions, assessments and decision-making Monitors emerging cyber and AI risks, regulatory changes, and industry best practices for nuclear and critical infrastructure, updates strategy accordingly Performs hands-on configuration, monitoring and system administration of enterprise vulnerability management tools (e.g. Qualys) and Governance, Risk and Compliance (GRC) platforms (e.g. ServiceNow GRC, X-Analytics) Performs other duties as assigned

Requirements

Translates complex cybersecurity and compliance risks into executive-level insights for technical and non-technical stakeholders through advanced communication skills
Demonstrates mastery in IT risk management, cybersecurity frameworks, and regulatory compliance, leading strategic risk initiatives and mentoring teams on risk assessment methodologies
Proven ability to lead cross-functional teams in risk assessment and compliance initiatives while fostering continuous improvement in risk management practices
Proven ability to deliver timely completion of risk mitigating actions, regulatory assessments and compliance programs
Proven ability to analyze complex risk scenarios, threat intelligence, and compliance information to inform decision-making and risk mitigation strategies
Maintains strict confidentiality of sensitive cybersecurity intelligence, risk assessments, and regulatory examination findings
Demonstrates mastery in the relevant specialty area, spearheading initiatives, providing mentorship to team members, and championing innovation and strategic enhancements across the organization
Advanced communication skills used to drive organization change initiatives and convey complex ideas and project strategies in a clear and compelling manner to stakeholders
Proven ability to lead and collaborate with diverse teams to achieve common goals, while providing mentorship and guidance to team members, fostering a culture of continuous improvement and excellence
Demonstrated ability to strategically allocate resources to manage a portfolio of programs; prioritizing tasks, meeting deadlines, and proactively mitigating program risks to ensure successful outcomes
Advanced ability to use research, analysis, and stakeholder feedback to influence and execute program strategies while remaining up-to-date with industry regulations and compliance standards
Advanced proficiency in solving complex and multifaceted problems using data, trend, and problem analysis to inform decision making improvements to the program portfolio
Exemplifies exceptional ability to seek out learn from feedback, coaching, and new experiences. Anticipates challenges and leverages learnings to drive strategic innovation and mentor cross-functional teams
Lead cross-departmental collaboration efforts to strategically harness collective creativity and drive significant innovation within the organization. Exhibit exceptional communication skills to effectively convey complex ideas and facilitate high-level discussions. Demonstrate a proven track record of impactful cross-functional projects, ensuring alignment and synergy among diverse teams
Ability to work and maintain confidentiality of highly sensitive/private information
High School Diploma or GED
Six or more years of professional work experience
Four or more years of experience in risk management, audit, or cybersecurity governance in regulated industries
Must be able to work prolonged periods of sitting at a desk and working on a computer
Must be able to work under minimal supervision
Must be able to sit, stand, walk, stoop, kneel, crouch, climb, and crawl
Must be able to lift 25 pounds
Must have a US state or territory issued Real ID compliant driver’s license or identification card
All INPO employees are expected to abide by behavioral expectations as outlined in INPO’s Core Values, Team Effectiveness Attributes, and Leadership Effectiveness Attributes
Employment is dependent upon successfully completing a pre-employment background check and drug and alcohol test
This position may require obtaining unescorted access status
This position requires direct or indirect access to certain export-controlled technology, for which INPO may be required to obtain an export license in accordance with applicable U.S. export control laws and regulations. If an export license is required, any offer of employment at INPO for this position is contingent upon receipt of the export license or authorization

Nice To Haves

Bachelor's degree in cybersecurity, computer science, information technology, information assurance, network engineering or network security, or a related field of study
Certified in Risk and Information Systems Control (CRISC)
Certified Information Security Manager (CISM)
Certified Information Systems Security Professional (CISSP)
Six or more years of experience in risk management, audit, or cybersecurity governance in regulated industries
Experience developing, implementing, and maturing GRC program maturity
Nuclear industry or critical infrastructure experience with regulatory compliance requirements
Third-party risk management experience including vendor assessments and supply chain risk analysis
Executive reporting and stakeholder management experience with C-suite and Board-level presentations

Responsibilities

Matures INPO's cybersecurity program, aligning governance, controls, and reporting with NIST Cybersecurity Framework 2.0 and NIST AI Risk Management Framework by setting the standard for security at INPO
Refines and maintains IT and security policies, standards, and procedures that operationalize DOE/DOC 810, NRC, and ISO requirements within INPO's compliance environment
Maintains the IT risk register and applies assessment and maturity methods to drive consistent identification, analysis, and mitigation tracking across IT
Ensures IT integrates risk considerations into technology initiatives, architecture decisions, and change management processes
Translates technical risks into executive-level insights that inform prioritization, investment and strategic decisions for the CFO, IT Director, and Senior Leadership Team
Produces monthly metrics and quarterly reports on risk posture, trends, maturity, and recommended actions
Oversees third-party risk across SaaS, service providers, and supply chain to ensure external relationships meet risk tolerance and contractual/compliance obligations
Coordinates IT audits, regulatory examinations, security awareness training, penetration testing, and independent assessments; drives timely remediation and continuous compliance
Applies security intelligence from Security Operations Center (SOC)/Managed Detection and Response (MDR) vendors to inform actions, assessments and decision-making
Monitors emerging cyber and AI risks, regulatory changes, and industry best practices for nuclear and critical infrastructure, updates strategy accordingly
Performs hands-on configuration, monitoring and system administration of enterprise vulnerability management tools (e.g. Qualys) and Governance, Risk and Compliance (GRC) platforms (e.g. ServiceNow GRC, X-Analytics)
Performs other duties as assigned