Cyber Information Assurance Analyst I

Arizona Public Service - APS; Phoenix (AZ); On-site; USD 95,000 - 125,000; Full time

Job summary

Arizona Public Service (APS) seeks an Information Assurance professional to design and implement data security across applications, databases, and procedures, ensuring privacy by design and risk-driven controls. You will work with stakeholders to align controls with regulatory requirements and audit expectations.

The role emphasizes threat assessment, data life-cycle protection, and supporting enterprise compliance programs, with guidance from senior analysts and cross-functional teams.

Qualifications

• Bachelor's degree with 1 year of relevant experience or equivalent.
• Basic technical subject knowledge within a job area or system.
• Experience applying information security frameworks and regulatory requirements.

Responsibilities

• Follows information security and data privacy framework controls to protect APS sensitive information.
• Maintains inventory of applications and databases containing sensitive data and builds privacy by design into lifecycle.
• Performs risk management tasks and assists in mitigation processes.
• Participates in vendor risk management and assesses vendor risk.
• Monitors applications and databases for unusual activity.
• Assists in compiling regulatory compliance evidence and training workforce on data handling.
• Reports security concerns to senior analysts.

Skills

Risk management

NIST/CIP/GAPP

Info assurance

Malware detection

IAVM

Security design

Education

Bachelor's degree in CS or related field

Job description

Our present and future success depends on the creative and dedicated people of our company who demonstrate the principles outlined in the APS Promise: Design for Tomorrow, Empower Each Other and Succeed Together.

Summary

Responsible for the design and implementation of information assurance and data security in applications, software, databases, flat files and procedures. Assesses and mitigates data security threats and risks throughout the data life cycle and validates data security requirements through analysis.

Supports compliance and audit activities by helping ensure appropriate data security controls, documentation, and processes are in place and operating effectively. Partners with internal stakeholders and audit teams to support control assessments, address findings, identify potential compliance gaps, and strengthen the organization’s security and control environment.

Minimum Requirements

• Bachelors' degree in computer science, business administration, finance, accounting or related field and one (1) year of prior relevant experience or equivalent combination of education and directly related experience.
• Requires basic technical subject matter knowledge within a job area or system

Preferred Special Skills, Knowledge or Qualifications

• Risk management and information security framework experience National Institute of Standards and Technology (NIST), Critical Infrastructure Protection (CIP) or Generally Accepted Privacy Principles (GAPP)
• Knowledge of network and information assurance; security and malware detection and prevention technologies; information assurance regulations and standards; compliance; and software (applications and programming); communication protocols; security design; Information Assurance Vulnerability Management program (IAVM) and other information assurance programs.
• Skill in design and implementation of information assurance programs; supporting secure systems operations.
• Ability to design and implement information assurance and security systems with multiple requirements, including but not limited to business continuity, physical security, data security; educate internal and external stakeholders on information assurance policies and practices.

Major Accountabilities

• Follows information security and data privacy framework controls to ensure adequate protection procedures exist around APS' sensitive information.
• Maintains and regularly reconciles the inventory of applications and databases containing sensitive information to build "privacy by design" into project and data lifecycle.
• Performs risk management tasks, identifying cyber security risks and assisting in development of processes to mitigate them.
• Participate in vendor risk management program; assess risk of vendors in possession of APS' sensitive information.
• Assists in monitoring applications and databases for unusual activity.
• Performs basic data loss prevention reviews, monitoring data received/sent on premises and/or via cloud solutions.
• Participates in the implementation of technical standards, procedures and guidelines; receive oversight from more advanced analysts.
• Assists in the coordination, design, evaluation and submission of critical regulatory compliance evidence required to show controls, solutions, policies and procedures.
• Assists in security and privacy awareness efforts to educate APS' workforce on safe use and handling of data.
• Utilizes systems that help prevent cyber threats such as data breaches or inadvertent over-sharing of data classified as sensitive.
• Reports any current or future security concerns to more advanced analysts.
• Conducts research and analysis to solve information assurance related problems that may include security risks

Key Level Differentiators

• Works to achieve operational targets within IS and Cyber Information Assurance which has some impact on the overall achievement of results for the department.
• Work is of limited scope, typically on smaller, less complex projects/ assignments.
• Implements or supports projects/ assignments, under close supervision.
• Uses existing methods designed by other technical colleagues.
• Decisions made impact self and has low impact on own and related job family and department

Export Compliance / EEO Statement

This position may require access to and/or use of information subject to control under the Department of Energy's Part 810 Regulations (10 CFR Part 810), the Export Administration Regulations (EAR) (15 CFR Parts 730 through 774), or the International Traffic in Arms Regulations (ITAR) (22 CFR Chapter I, Subchapter M Part 120) (collectively, 'U.S. Export Control Laws'). Therefore, some positions may require applicants to be a U.S. person, which is defined as a U.S. Citizen, a U.S. Lawful Permanent Resident (i.e. 'Green Card Holder'), a Political Asylee, or a Refugee under the U.S. Export Control Laws. All applicants will be required to confirm their U.S. person or non-US person status. All information collected in this regard will only be used to ensure compliance with U.S. Export Control Laws, and will be used in full compliance with all applicable laws prohibiting discrimination on the basis of national origin and other factors. For positions at Palo Verde Nuclear Generating Stations (PVNGS) all openings will require applicants to be a U.S. person.

Pinnacle West Capital Corporation and its subsidiaries and affiliates ('Pinnacle West') maintain a continuing policy of nondiscrimination in employment. It is our policy to provide equal opportunity in all phases of the employment process and in compliance with applicable federal, state, and local laws and regulations. This policy of nondiscrimination shall include, but not be limited to, recruiting, hiring, promoting, compensating, reassigning, demoting, transferring, laying off, recalling, terminating employment, and training for all positions without regard to race, color, religion, disability, age, national origin, gender, gender identity, sexual orientation, marital status, protected veteran status, or any other classification or characteristic protected by law.

For more information on applicable equal employment regulations, please refer to EEO is the Law poster. Federal law requires all employers to verify the identity and employment eligibility of every person hired to work in the United States, refer to E-Verify poster. View the employee rights and responsibilities under the Family and Medical Leave Act (FMLA).

Arizona Public Service is a smoke free workplace.

Home based:

• Employees are expected to reside in Arizona (or New Mexico for Four Corners-based employees).
• Working from a home office requires adequate technology and an appropriate ergonomic set up.
• Role types are subject to change based on business need.