Senior Information Assurance Analyst - Oahu

Overview

Senior Information Assurance Analyst - Oahu

Date:
Sep 15, 2025

Location:

Honolulu, Hawaii (HI), US, 96813

Company: hawaiianel

Posting End Date:
This position will remain open until filled. Early applications are encouraged.

Brief posting description: The P EJ INFORMATION ASSURANCE Department of the P INFORMATION ASSURANCE Division at Hawaiian Electric Company has 1 Management vacancy available. (Role: Professional)

• Oversees or performs the assessments of Company systems and networks and identifies deviations from cybersecurity policies, acceptable configurations, or guidance.
• Provides consulting-level knowledge and expertise for the Information Assurance (IA) division, including development and enforcement of cybersecurity policies & standards, cybersecurity risk management, IT and OT compliance, and secure integration of grid technologies and cloud services.
• Supports development of detailed plans and provides requirements for information systems’ security controls and security monitoring solutions.
• Performs security control reviews to validate that designed controls operate effectively.
• Develops policies, standards, and procedures to ensure that security controls are adequately designed.

• Performs cybersecurity assessments and provides security control requirements for IT and OT projects, including externally hosted applications and grid technology projects.
• Develops and manages programs for privacy, e-discovery, security awareness training, digital forensics, patch management, vulnerability remediation, and other security and compliance programs.
• Supports detailed review and approval processing for policies, processes, and procedures necessary to support the Company’s cybersecurity and compliance requirements.
• Ensures that internal controls, processes, practices, and standards are developed, maintained, and tested to meet policy and compliance requirements.
• Supports business continuity planning, disaster recovery planning, and the Company’s Cybersecurity Incident Management Team (CS-IMT), with occasional on-call support.
• Participates in Company emergency response activities as assigned.

• Knowledge Requirements
• Computer networking concepts and protocols, and network security methodologies.
• Risk management processes (e.g., methods for assessing and mitigating risk).
• Cybersecurity and privacy principles and organizational requirements (confidentiality, integrity, availability, authentication, non-repudiation).
• Laws, regulations, policies, and ethics related to cybersecurity and privacy.
• Cyber threats and vulnerabilities.
• Cryptography and cryptographic key management concepts.
• Data backup and recovery concepts.
• Host/network access control mechanisms (e.g., ACLs).
• Network access, identity, and access management (PKI, OAuth, OpenID, SAML, SPML).
• Network traffic concepts (TCP/IP, OSI, ITIL).
• Programming language structures and logic.
• System and application security threats and vulnerabilities (e.g., XSS, injections, race conditions, malware).
• Network attack concepts and their relation to threats and vulnerabilities.
• System administration, network, and operating system hardening techniques.
• Different classes of attacks (passive, active, insider, etc.).
• Different cyber attackers (script kiddies, insider threat, state-sponsored, etc.).
• Cyber-attack stages (reconnaissance, scanning, enumeration, access, privilege escalation, maintenance, etc.).
• Network security architecture concepts including topology, protocols, components, and defense-in-depth.
• Security models (Bell-LaPadula, Biba, Clark-Wilson).
• Ethical hacking principles and techniques.
• Pent ration testing principles, tools, and techniques.
• Conceptual knowledge of NIST, ISO 27000 series, OWASP, and other security frameworks/standards.
• Conceptual knowledge of utility business and related OT systems (SCADA, DCS).

• Skills Requirements
• Conducting vulnerability scans and recognizing vulnerabilities in security systems.
• Assessing the robustness of security systems and designs.
• Detecting intrusions via intrusion detection technologies (e.g., Snort).
• Mimicking threat behaviors.
• Use of penetration testing tools and techniques.
• Use of social…