Info Compliance Analyst/Sr Info Compliance Analyst

MidAmerican Energy Company; Des Moines (IA); On-site; USD 110,000 - 150,000; Full time

Job summary

MidAmerican Energy Company is seeking an Information Security Compliance Specialist to support ISO 27001/27019 controls, develop and maintain ISMS for affiliates, and coordinate internal/external audits. The role involves risk assessment, policy development, incident response, and ongoing program improvements across multiple teams and sites.

The ideal candidate has a bachelor’s degree in a related field, 8+ years in info security/audit, and relevant certifications.

Qualifications

• Bachelor’s degree in information systems, computer science, or related field; or equivalent work experience. Typically four years of related, progressive work experience if no degree.
• Willingness to travel for pre-audit inspections; travel up to 10%–25%.
• Eight years of progressively advanced technical experience in information security, accounting or audit role.
• Knowledge of information security best practices; CISM or CISSP certification.
• Deep technical knowledge of operating systems, databases, networks and disaster recovery practices.
• Excellent oral and written communication skills.
• Ability to prioritize and handle multiple enterprise-level assignments.
• Accessible after business hours to guide on-call staff in escalation situations.

Responsibilities

• Identify and implement cyber security initiatives supporting ISO 27001 and ISO 27019 controls.
• Support ISMS development and maintenance for one or more affiliate.
• Lead or support special projects, analyses, and present recommendations to management.
• Develop and implement new strategies in response to changing conditions.
• Maintain information security policies, procedures, standards, and controls.
• Coordinate with internal and external cyber security auditors.
• Execute control activities to evidence IT controls compliance.
• Lead cyber security maintenance and continuous improvement activities.
• Define third-party service levels for ISO 27001/27019 scoping.
• Advise management on enterprise information security requirements.
• Update training materials supporting security policies and procedures.
• Assess and mitigate cyber security risks and threats.
• Share best practices with BHE IT/security staff.
• Support KPI reporting and status updates for information security.
• Support business continuity planning and incident response; update incident response plans.
• Act as information security subject matter expert for the enterprise.
• Manage forensic and investigation activities.
• Perform other duties as assigned.

Skills

Information security

Risk assessment

Compliance/audit

Incident response

Communication

Education

Bachelor’s degree in information systems or computer science

CISM or CISSP certification

Job description

Job Description

Supports the implementation and maintenance of information security systems in support of ISO 27001 and ISO 27019 certification. Supports change management of changes to the information security policy and procedures and supporting IT controls. Manages continuous improvement program activities for cyber security for the one or more BHE US Affiliates. Performs risk assessments and manages remediation of risk mitigation actions. Researches, analyzes, develops and implements new strategies, programs, and/or processes in response to changing internal and external conditions. Coordinates or executes IT controls.

Responsibilities

• Identify, prescribe, and implement key cyber security initiatives in support of ISO 27001 and ISO 27019 controls for the pipeline group. Act as advocate for the programs.
• Support the development and maintenance of Information Security Management System (ISMS) for one or more BHE US affiliate.
• Supports and/or leads special projects, studies and analyses, develops alternatives, presents recommendations to management and influences management decisions.
• Researches, analyzes, develops and implements new strategies, programs, and/or processes in response to changing internal and external conditions.
• Support the development and maintenance of information security policies, procedures, standards, controls and other related documents
• Coordinate and lead interactions with internal and external cyber security auditors
• Execute control activities to evidence our compliance with IT controls
• Lead cyber security maintenance and continuous improvement activity identified through internal processes or cyber security related audits.
• Support the development and documentation BHE US Affiliate third party services and service levels for ISO 27001 and ISO 27019 scoping for the affiliates.
• Consult with management, teams and individuals to provide strategical and tactical direction regarding enterprise information security requirements, policies, procedures and standards.
• Coordinate updates to training materials that support the information security policies and procedures
• Oversee and coordinate efforts to assess and mitigate cyber security risks and threats.
• Coordinate with BHE IT and information security staff as well as BHE chief security officer staff to share best practices and cyber security initiatives.
• Support reporting related to information security key performance indicators and status reporting
• Support business continuity planning, cyber security incident response and management. Coordinate incident response plan creation and updates
• Support the enterprise as an information security subject matter expert.
• Manage and coordinate forensic and investigation activities
• Perform other duties as assigned

Qualifications

• Bachelor’s degree in information systems, computer science, accounting, finance, business, information systems, computer science, or a related technical field; or equivalent work experience. (Typically four years of related, progressive work experience would be needed for candidates applying for this position who do not possess a bachelor’s degree; a minimum of four years directly-related technical experience in audit, finance, accounting, or information security program compliance support is required.)
• Employee must be able and willing to travel to perform pre-audit inspections and support external auditor at site locations. Travel is typically up to one week at a time and may make up 10% to 25% of the work schedule.
• Eight years of progressively advanced technical experience in an information security, accounting or audit role for the Sr Information Compliance Anayst.
• Demonstrated knowledge of information security best practices as evidenced through achievement or pursuit of one or more advanced certifications, such as CISM or CISSP.
• Deep technical knowledge of operating systems, databases, networks and disaster recovery practices.
• Excellent oral and written communication skills, including presentation skills.
• Ability to recognize, respond, escape and manage complex technical problems.
• Effective interpersonal and customer relationship skills.
• Effective analytical, problem-solving and decision-making skills.
• Ability to prioritize and handle multiple enterprise level assignments.
• Accessible after business hours to guide, manage and support on-call staff in escalation situations.

About Us

MidAmerican Energy Company, a Midwest utility, provides regulated electric and natural gas service to more than 1.6 million customers in Illinois, Iowa, Nebraska and South Dakota. The company owns and operates a portfolio of power-generating assets, approximately 61% of which is wind generation.

About The Team

MidAmerican Energy Company is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion or religious creed, age, national origin, ancestry, citizenship status (except as required by law), gender (including gender identity and expression), sex (including pregnancy), sexual orientation, genetic information, physical or mental disability, veteran or military status, familial or parental status, marital status or any other category protected by applicable local, state or U.S. federal law. Employees must be able to perform the essential functions of the position, with or without an accommodation.