Information Security Analyst III

Company Overview (For Calpine Corp Positions / Retail might have another overview)

Calpine Corporation is America's largest generator of electricity from natural gas and geothermal resources with operations in competitive power markets.

Its fleet of 76 power plants in operation and one under construction represents nearly 26,000 megawatts of generation capacity.

Through wholesale power operations and its retail businesses, Calpine serves customers in 22 states, Canada and Mexico. Its clean, efficient, modern and flexible fleet uses advanced technologies to generate power in a low-carbon and environmentally responsible manner.

The company was established on the premise that a strong commitment to the environment is inextricably linked to excellence in power generation and corporate responsibility.

Since its founding in 1984, Calpine has led the power industry in its unwavering commitment to environmental stewardship.

In addition, its renewable geothermal plants use steam generated deep below the earth's surface to produce clean, renewable electricity.

Job Summary (includes but is not limited to the following, other duties may be assigned)

The Information Security Analyst III is primarily responsible for executing the cybersecurity incident response lifecycle in conjunction with the team, administering systems and processes owned by the cybersecurity team, and validating / maturing the efficacy of all systems and processes that have a significant impact on the cybersecurity posture of the company.

The Information Security Analyst III possesses a strong technical background and understands risk mitigation and technical controls in some combination of the following areas : incident response, Information Security Risk Management (ISRM), secure architecture, identity, business continuity, end-point security, SIEM, web security, email security, and vulnerability management.

This position requires strong written and oral communication skills, as well as the ability to communicate detailed, technical information in a manner comprehensible by individuals at varying degrees of experience and skill level.

Job Responsibilities

• Investigate, analyze, and respond to cybersecurity incidents.
• Administer technologies and processes owned by the cybersecurity team including those used for web filtering, end-point protection, incident response, email security, and security awareness.
• Execute processes that have a significant impact on cybersecurity including incident response, Information Security Risk Management (ISRM), secure architecture, identity, business continuity, end-point security, SIEM, web security, email security, and vulnerability management.
• Analyze current computer systems and procedures, and design information systems solutions to help the organization operate more securely, efficiently, and effectively.
• Assess systems and networks to identify deviations from acceptable configurations, enclave policy, or local policy. Measure effectiveness of defense-in-depth architecture against known vulnerabilities.
• Analyze technologies to ensure comprehensive protection exists to prevent unauthorized entry into the company networks and systems.
• Support automation and orchestration to maximize team talent and reduce routine tasks.
• Recommend necessary changes to the information security team to ensure the company’s systems are fully compliant with all applicable regulatory requirements and privacy laws.
• Stay abreast of the security industry threat landscape, specifically within the company’s industry.
• Recognize personal developmental needs and be proactive in obtaining the coaching, networking, and training needed to ensure continued success in the position.
• Create a working environment that is conducive to two-way communication, teamwork, and learning.
• Utilize open communication to ensure the standards, expectations and goals of the organization are respected and upheld.
• Assume responsibility for other duties as required or assigned.

Job Requirements

• Bachelor’s degree in computer science, information assurance, Management Information Systems (MIS) or related field, or equivalent.
• Preferably 6+ years of technical hands-on security experience.
• Experience dealing with some combination of information security incidents related to malicious websites, malicious emails, malware, unauthorized access, Denial of Service and password attacks.
• Hands on technical experience with some combination of the following security solutions : MS Windows Defender, MS Exchange Online Protection, MS Azure Security Center, MS Active Directory, Cisco Umbrella, Tanium, Cisco firewalls, Fortinet firewalls, Splunk, MS Azure Sentinel or Rapid 7.
• Knowledge of some combination of security standards and frameworks such as NIST, NERC CIP, TSA Pipeline, PCI, and SOX.
• Experience with cloud security and DevSecOps.
• Demonstrate strong written and oral communication skills.
• Demonstrate solid organizational skills and the ability to multi-task and prioritize workload.
• Demonstrate excellent judgment and the ability to make quick decisions and think outside the box when working with complex situations.
• Demonstrate a high level of flexibility.
• Possesses a high level of integrity, trustworthiness, and confidence, and represent the company and its management team at the highest level of professionalism.
• Demonstrate strong analytical skills and is effective at interpreting and applying applicable regulation.
• Work effectively with a variety of personalities and can adapt approach to effectively reach and mentor the team. Use this skill as well as functional knowledge to both earn and maintain a high level of credibility with the team.
• CEH Certified Ethical Hacker (CEH) preferred
• GIAC Certifications preferred
• CISSP (Certified information systems security professional) preferred
• CISM (Certified Information Security Manager) preferred

Additional Calpine Information

• Equal Opportunity Employer of Minorities, Females, Protected Veterans, and Individuals with Disabilities.
30+ days ago