Sr Info Security Analyst

SUMMARY OF JOB RESPONSIBILITIES AND REQUIREMENTS

JOB TITLE: Sr Info Security Analyst
REQUISITION ID: INF00FA
DEPARTMENT: Information Security - Topeka General Office or Kansas City Headquarters
LOCATION: Topeka, KS
Kansas City, MO
PAY RANGE:
Sr Info Security Analyst: $94,600 - $126,100

Scheduled Work Hours: Monday - Friday, 7:00 a.m. - 4:00 p.m. 60% in office, 40% remote (Other hours as required)

Summary of Primary Duties and Responsibilities:
This position provides support to ensure compliance with North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards and Evergy Corporate Information Security Policies. The position will encompass the task of overseeing and managing networking systems, while also ensuring the efficacy of firewall-based security measures. It's imperative to accurate documentation concerning vital cyber assets for safeguarding purposes. The individual will operate in a collaborative, cross-functional manner, working closely with vendors, engineers, operators, technicians, and IT personnel.

Duties and Responsibilities:
* Implement, administer, and optimize cybersecurity controls including SIEM, EDR/XDR, email security, network detection and response (NDR), cloud security, identity security, and security automation platforms.
* Research, implement, and maintain cybersecurity technologies and best practices across on-premises, cloud, and hybrid environments.
* Provide recommendations that enhance the organization's cybersecurity strategy, risk posture, resiliency, and adoption of emerging technologies.
* Monitor, investigate, and respond to cybersecurity events, alerts, and incidents using SIEM, EDR, NDR, SOAR, cloud, and identity security monitoring platforms.
* Participate in incident response, threat hunting, playbook development, threat mitigation, and recovery activities to reduce organizational cyber risk.
* Perform cybersecurity risk assessments and provide recommendations to mitigate identified threats and vulnerabilities while aligning with organizational risk tolerance.
* Protect enterprise information, operational technology (OT), cloud resources, and critical infrastructure assets through implementation of security controls and monitoring processes.
* Support cybersecurity governance, regulatory compliance, and audit activities, including NERC CIP, NIST, CIS Controls, and other applicable regulatory frameworks.
* Lead or support cybersecurity risk assessments, vulnerability assessments, and remediation efforts across technology environments.
* Mentor junior analysts and provide technical guidance during security investigations and projects.
* Provide operational support for cybersecurity technologies and participate in incident response and on-call activities as required
Participate in an on-call rotation supporting cybersecurity operations, incidents, and critical security technologies.

Education and Experience Requirements:

• A bachelor's degree is typically required in Information Systems, Computer Science or related field. Relevant cybersecurity certifications such as CISSP, GIAC, Security+, CySA+, CCSP, or equivalent industry-recognized certifications are preferred.
• Successful candidates typically possess seven or more years of progressively responsible experience in cybersecurity, information security, risk management, incident response, security operations, compliance, or related technology disciplines.
• Demonstrated technical aptitude and the ability to evaluate, learn, and apply emerging technologies, security concepts, and industry best practices are required. Must be capable of independently analyzing security threats, vulnerabilities, risks, and operational issues and providing effective recommendations for remediation and risk reduction.
• Strong oral and written communication skills are required, including the ability to communicate technical concepts, risks, and recommendations to technical, operational, and executive audiences.

Skills, Knowledge, and Abilities Required:
* Ability to communicate effectively with technical and non-technical stakeholders across the organization and with external partners, vendors, auditors, and regulatory entities.
* Working knowledge of security operations, incident response, threat detection, vulnerability management, security monitoring, threat intelligence, security automation, and risk management practices.
* Knowledge of enterprise operating systems, endpoint management, and system security principles, with the ability to quickly learn and support new technologies and platforms.
* Understanding of networking concepts, protocols, traffic analysis, and network security principles required.
* Knowledge of endpoint security technologies, malware prevention, endpoint detection and response, and host-based security controls.
* Understanding and good working knowledge of major firewall vendors
* Ability to independently analyze security events, identify risks, develop recommendations, and communicate findings to appropriate stakeholders.
* Effective oral and written communication skills are necessary, especially the ability to present technical information to an audience with a broad range of information technology experience.
Licenses, Certifications, Bonding, and/or Testing Required: None

Working Conditions: Mix of at home and office environment.

Evergy has a clear mission - To empower a better future. Evergy chooses to live this mission by valuing People First. We know that to lead the responsible energy transition and provide affordable, reliable, and sustainable service to our customers and communities, we need a team with a variety of backgrounds, perspectives and skills. We are committed to building a team where everyone - regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status - has a voice and can bring their best every day. Evergy is proud to be an equal opportunity workplace and is an affirmative action employer.

Disclaimer: The above information has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job.