GRC Security Analyst II

Essential Utilities, Inc.

Job Title:

GRC Security Analyst II (Governance & Risk)

• Manage execution of both enterprise-wide and focused risk, threat, and vulnerability assessments, including but not limited to Security Awareness, Vulnerability, Configuration, and Third-Party Assessments.
• Analyze and prioritize risk, vulnerability, and compliance findings to define remediation priorities considering all available data sources; partnering with technology and business stakeholders to socialize and implement remediation plans.
• Define and manage qualitative and quantitative metrics and reporting to measure the success of vulnerability, third party, security awareness, security awareness, configuration, and asset management remediations.
• Ability to lead ongoing vulnerability management processes, including working with IT and business stakeholders to prepare vulnerability remediation plans, track progress, and reduce overall vulnerability exposures.
• Participate in development, implementation and operation of control/compliance frameworks and security best practices based on ISO 27001/27002, NIST (800‑30, Cyber Security Framework/CSF), COBIT, Critical Security Controls, CIS Configuration Benchmarks.
• Monitor compliance with security configuration standards for servers, endpoints, software, and networking platforms based on CIS Benchmarks.
• Work closely with IT, development, and operations teams to ensure the integration of security practices into the software development lifecycle (SDLC) and IT operations.
• Lead or assist with vendor and 3rd party risk assessments.
• Create/maintain documentation of security solutions, services, configurations, and processes.
• Work closely with engineers focused on intrusion detection, incident response and security operations to manage risk related to existing and emerging threats.
• Collaborate with other security engineers to analyze, process, integrate, communicate, and respond to threat intelligence.
• Ability to participate in or lead development, improvements and updates to continually improve security controls, policies, guidelines, processes and procedures.
• Develop and deliver security awareness training programs for employees to enhance their understanding of security best practice to ensure that security and risk management continue to be integrated into the corporate culture.
• Lead development and operation of the security awareness program to ensure that security and risk management continue to be integrated into the corporate culture.
• Implement and maintain controls for compliance and privacy.
• Act as liaison to internal and external audit teams as needed.
• Provide escalation support for the Information Technology Help Desk as required.
• Ability to work off hours maintenance windows and participate in rotating on call shift periodically.
• Ability to work alone or function effectively as part of a team.
• All other duties as assigned by management.

• Bachelors in Information Technology, Computer Science, Cyber Security, Security and Risk Analysis, Information Assurance.
• 3‑5 years of previous Governance & Risk experience.
• Candidates must have a minimum of one of the following certifications or will be required to obtain within the first 12 months: CISSP, GIAC (GSEC, GSNA), CRISC, CISA, CISM, CCSP, SSCP, CAP, CSSLP, CSX Practitioner.
• Experience working with assessment tools such as Qualys Policy Compliance and CIS‑CAT.
• Experience developing and using Qualys, or other vulnerability management, platforms with experience in multiple modules and/or areas:
  Vulnerability Management, Policy Compliance, Continuous Monitoring, Policy Compliance, Web Application Scanning and Asset Management.
• Experience leading security awareness program development including:
  Leading regular phishing assessment campaigns.
• Creating innovative security awareness campaigns using solution provider and custom‑developed tools/trainings designed to be flexible and adaptable across a diverse employee population (executives, engineering, marketing and communications, finance, customer service, etc.).
• Participate in aligning the security awareness program with the enterprise’s greatest risks and measure the…