Information Security Specialist; Cyber-Engineer

Salary Grade: G05
Minimum Midpoint Maximum
$94,831- $128,022- $161,213

This position is covered by NERC CIP cyber security standards. Prior to being hired, promoted, or transferred into the position, the candidate must successfully pass a Personnel Risk Assessment, which includes identity verification and a criminal background check. Prior to being granted unescorted access to cyber secure areas, the candidate must attend cyber security training. Annual cyber security training is also required.

Under general supervision, plans, coordinates, and implements security measures to safeguard information in computer files against accidental or unauthorized modification, destruction, or disclosure.

• Develops and maintains an effective Vulnerability Management program through vulnerability review, planning, tracking, reporting, and coordination with other technical and administrative staff in all departments
• Develops, implements, maintains, and enforces information protection, information security, corporate policies, standards, and practices throughout the company
• Develops and provides recommendations to management for overall information protection architecture and program for the Company
• Develops, implements, supports and maintains employee training and awareness programs for information protection and security
• Partners with the Information Services Review Board and PNM Audit Services personnel to ensure information protection issues for corporate data, systems, networks, and other information assets are addressed to the satisfaction of all entities
• Develops effective working relationships with mid- and senior-level management of the various business units throughout the company to obtain support and acceptance of security policies and practices, and develop support for policy enforcement
• Manages the Information Security (IS) staff and functions in Information Services, assuring effective administration of security activities
• Manages and reports regularly on all IS projects and activities
• Works closely with Security Administrators and Technical staff for various systems and networks to ensure that adequate preventive and detection controls are in place
• Provides coordination and guidance to any decentralized or application security administration functions
• Assists in contingency planning and testing on a regular basis to ensure company information assets are recoverable and protected
• Manages the IS work involved in all internal and external security-related audits involving systems, networks, and data
• Participates with internal departments in risk assessment activities and new software development projects to ensure data security
• Accesses control and business recovery procedures inherent in all new information technology implementations
• Provides appropriate security metrics to senior management and other departments using available security tools and services

• In-depth management, negotiation, technical skills, and demonstrated leadership and customer service skills
• Understanding of and ability to relate business requirements and risks to technology implementation for security related issues
• Excellent skills in risk assessment processes, policy development, proposals, work statements, product evaluations, and delivery of technology
• Knowledge of forensics, incident analysis, and incident response management
• Demonstrated skills in personnel management, budget management, and conflict management
• Ability to stand firm on issues yet be flexible and creative when working with customers to find effective solutions
• Ability to organize, create, and deliver technical proposals and presentations to peers and management
• Ability to understand and interpret laws and regulatory requirements related to information protection, and develop and implement appropriate processes to keep the Company in compliance and reduce legal liabilities
• Project Management knowledge and experience a strong plus

• MINIMUM EDUCATION AND/OR
  
  EXPERIENCE:
  
  Bachelor's degree from four-year college or university in Information Resource Management, Business Computer Systems, Computer Science or Computer Security with five to seven years related experience, or equivalent combination of education and/or experience related to the discipline.
• CERTIFICATES, LICENSES, REGISTRATIONS:
  Certification in security or systems control related field: I.e., CISSP, CISA, or CISM.
• SUPERVISORY…