Security Analyst

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full-Time FAYETTEVILLE, AR, US

Join our growing team and discover why Summit Utilities, Inc. continues to earn national and regional recognition as an employer of choice. Our recognitions include Best Places to Work in Maine );
Best Places to Work in Arkansas (2020, 2023, 2025); Best Places to Work in Oklahoma );
Best Places to Work in Missouri (2023 and 2026);
Best Places to Work in Colorado (2025);
Forbes America's Best Small Employers (2023); and, most recently, Proud and Purposeful Employer (2026).

Summit is a growing natural gas utility providing safe, reliable, and clean burning natural gas service to homes and businesses in Arkansas, Colorado, Maine, Missouri, Oklahoma, and Texas. Being part of the Summit team means embracing excellence and innovation, committing to safety each and every day, and doing all that we can to serve each other, our customers, and the communities where we live.

We aim to bring warmth and energy to everything we do.

We have an exciting opportunity for a Security Analyst I (SGL
15). This hybrid position may be based in our Little Rock, Fort Smith, or Fayetteville, Arkansas offices.

POSITION SUMMARY

The Security Analyst I protects Summit Utilities' business systems, operational technology (OT), and data by monitoring for threats, investigating and responding to security events, and owning assigned security control areas from start to finish. This role works across both the corporate IT environment and the Industrial Control Systems (ICS) and SCADA environment that supports Summit's natural gas distribution system, partnering closely with IT, SCADA, and Gas Control teams to keep operations safe, reliable, and secure.

Reporting to the Director of Information Security, the Information Security Analyst is an independent contributor who leads Tier-2 investigations, tunes detections, drives vulnerability remediation with system owners, and prepares evidence for audits and assessments aligned to the TSA Pipeline Security Directives, C2M2, NIST CSF, and NERC CIP. The role also helps build a strong security culture through awareness training, interactive exercises, and clear communication with employees at every level of the organization.

PRIMARY DUTIES AND RESPONSIBILITIES

• Monitor security alerts and log data across IT and OT environments; investigate suspicious activity and respond to Tier-2 security events from triage through resolution.
• Document, classify, and track security events and incidents; draft incident reports and escalate major incidents, and any event affecting OT operations, according to the incident response plan.
• Write and tune detection queries and correlation rules to improve alert quality and reduce false positives.
• Perform forensic analysis and evidence collection on suspicious devices; conduct legal hold actions and investigations when required.
• Apply threat intelligence from sources such as CISA and the DNG-ISAC to investigations and detections, mapping activity to MITRE ATT&CK for Enterprise and ISC.
• Coordinate with SCADA Analysts, SCADA Technicians, and Gas Controllers on OT alerts and response, following a safety-first, approval-required approach for any response action in OT environments.
• Review OT network monitoring alerts and support security visibility of control systems, including Remote Terminal Units (RTU), Programmable Logic Controllers (PLC), and field communication technologies.
• Support hardening, configuration, and testing of security updates for IT and OT systems and servers, aligned to operational change windows and high-availability requirements.
• Run and review vulnerability scans; prioritize findings by risk and asset criticality and partner with IT and OT system owners to remediate and track items to closure.
• Review Common Vulnerabilities and Exposures (CVE) and vendor advisories for exposure in IT and OT assets and recommend mitigations or compensating controls.
• Coordinate third-party vulnerability assessments and penetration tests and help develop remediation plans based on the findings.
• Conduct security reviews of applications, systems, and integrations before they go live.
• Manage MFA, SSO, and group policy security configurations and run periodic user and privileged access review cycles.
• Prepare control evidence and support control testing for TSA Security Directive alignment, the C2M2…