Posting End Date: This position will remain open until filled. Early applications are highly encouraged. BRIEF POSTING DESCRIPTION: The P EJ INFORMATION ASSURANCE Department of the P INFORMATION ASSURANCE Division at Hawaiian Electric Company has 1 Management vacancy available. (Role: Professional) JOB FUNCTION: • Oversees or performs the assessments of Company systems and networks and identifies where those systems/networks deviate from cybersecurity policies, acceptable configurations, or guidance. • Provides consulting-level knowledge and expertise for the Information Assurance (IA) division, which includes development and enforcement of cybersecurity policies & standards, cybersecurity risk management activities, information technology (IT) and operational technology (OT) compliance, and secure integration of grid technologies and cloud services. • Supports development of detailed plans and provides requirements for information systems' security controls and security monitoring solutions. • Performs security control reviews to validate the security controls as designed are operating effectively. • Develops policies, standards, and procedures to ensure that security controls are adequately designed. ESSENTIAL FUNCTIONS: • Performs cybersecurity assessments and provides security control requirements for IT and OT projects, including externally hosted applications and grid technology projects. • Develops and manages programs and processes for privacy, e-discovery, security awareness training, digital forensics, patch management, vulnerability remediation, and other security and compliance programs. • Supports detailed review and approval processing for various policies, processes, and procedures necessary to support the Company's cybersecurity security and compliance requirements. • Ensures that adequate and proper internal controls, processes, practices, and standards are developed, maintained, and tested in order to meet the Company's policy and compliance requirements. • Supports the business continuity planning, disaster recovery planning, and the Company's Cybersecurity Incident Management Team (CS-IMT), with occasional on-call support. • Participates in Company emergency response activities as assigned, including any activities required to prepare for such emergency response. BASIC QUALIFICATIONS: Knowledge Requirements • Computer networking concepts and protocols, and network security methodologies. • Risk management processes (e.g., methods for assessing and mitigating risk). • Cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation). • Laws, regulations, policies, and ethics as they relate to cybersecurity and privacy. • Cyber threats and vulnerabilities. • Cryptography and cryptographic key management concepts. • Data backup and recovery concepts. • Host/network access control mechanisms (e.g., access control list, capabilities list). • Network access, identity, and access management (e.g., public key infrastructure, Oauth, OpenID, SAML, SPML). • Traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]). • Programming language structures and logic. • System and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code). • Network attacks and a network attack's relationship to both threats and vulnerabilities. • System administration, network, and operating system hardening techniques. • Different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks). • Different cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored). • Different cyber-attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks, etc.). • Network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth). • Specific operational impacts of cybersecurity lapses. • Security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model). • Ethical hacking principles and techniques. • Penetration testing principles, tools, and techniques. • Conceptual knowledge of National Institute and Standards and Technology (NIST) Standards, ISO 27000 series, OWASP, and other security related frameworks and standards. • Conceptual knowledge of utility business and related Operational Technology Systems (SCADA, DCS Skills Requirements • Conducting vulnerability scans and recognizing vulnerabilities in security systems. • Assessing the robustness of security systems and designs. • Detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort). • Mimicking threat behaviors. • Use of penetration testing tools and techniques. • Use of social engineering techniques (e.g., phishing, baiting, tailgating, etc.). • Use of network analysis tools to identify vulnerabilities (e.g., fuzzing, nmap, etc.). • Reviewing logs to identify evidence of past intrusions. • Conducting application vulnerability assessments. • Performing impact/risk assessments. • Developing insights about the context of an organization's threat environment. • Collaborating with teammates and other employees. • Communicating effectively in writing and verbally. • Proven ability to analyze highly complex systems, demonstrating critical thinking skills, independent judgment, and the ability to work toward consensus in a complex business environment. • Must demonstrate analytical skills and the ability to communicate effectively (oral and written) and work with a variety of individuals throughout the organization including managers and executives. • Ability to operate autonomously with only general direction and guidance. Experience Requirements • Advanced (7-10 years) analysis and/or leadership experience in a multi-level service or consulting organization, preferably in an information technology, application security, network security or quality assurance capacity. Information security experience is required. • One or more of the following certifications (others will be considered): • Certified Information Systems Security Professional (CISSP) • Certified Information Security Manager (CISM) • Certified Information Security Auditor (CISA) • GIAC Security Leadership (GSLC) • Certified Cloud Security Professional (CCSP) • Security + • Systems Security Certified Professional (SSCP) Role: Professional Number of Vacancies: 1 Location: Honolulu - Oahu Hiring Range: The hiring range for the Senior Information Assurance Analyst - Oahu [Req ID 10573] position is $109,900.00 to $142,600.00. The person selected will be placed according to his/her skills and qualifications. The hiring supervisor is GERALD T ISERI JR. Interested individuals who are employees of affiliate companies should apply online. The application must clearly indicate the demonstrated experience/knowledge/skills/abilities the candidate possesses which specifically qualifies him/her for the position.