Cyber Security Analyst II

ALLETE is headquartered in Duluth, Minnesota, on beautiful Lake Superior, and has operations throughout the United States.

We invest in energy-centric businesses and transmission infrastructure.

Our companies include clean-energy producers and developers, and regulated utilities that already deliver more than 50% renewable energy.

Each of our businesses—Minnesota Power; Superior Water, Light & Power; ALLETE Clean Energy; New Energy Equity; ALLETE Renewable Resources; and BNI Energy—plays a unique and significant role in ALLETE's sustainability-in-action strategy.

Our culture drives excellence through our shared values of integrity, safety, people, and the planet.

ALLETE is seeking a Cyber Security Analyst II to join its Cyber Security & Compliance department to proactively and reactively defend ALLETE and its subsidiaries against evolving cyber threats.

In this new position, you'll have the exciting opportunity of first revamping the NERC-CIP-004 program, along with performing moderate ongoing maintenance on the revamped program.

Outside of facilitating the NERC-CIP-004 program, this role will utilize and contribute to enterprise cyber security technologies including Application Control (AC), Endpoint Detection and Response (EDR/XDR), Security Information and Event Management (SIEM), Security Orchestration Automation and Response (SOAR), Open-Source Intelligence (OSINT), and more! When you join ALLETE's Cyber Security & Compliance team as a Cyber Security Analyst II, you will work closely with cross-functional teams to ensure the confidentiality, integrity, and availability of data.

Additionally, you will assist in promoting security awareness and ensuring users understand and follow necessary procedures to maintain cybersecurity.

RESPONSIBILITIES:


* Enhance and sustain Minnesota Power's NERC CIP-004 program by working closely with standard owners and Subject Matter Experts (SME) to ensure compliance and continuous improvement.
+ This program includes Cyber Security Awareness Training (R1 & R2), Personnel Security Risk Assessment (R3) where you'll work with SMEs, Access Management (R4, R5, R6).


* Conduct regular assessments across systems to identify and mitigate vulnerabilities before they can be exploited.


* Perform moderately complex tasks related to the security of information systems and data under moderate direction.


* Assess, recommend, monitor, and maintain standards, guidelines, and procedures to protect information systems and data, while minimizing security risks.


* Mitigate a variety of issues by recognizing potential threats and responding to reported security breaches.


* Analyze, recommend, and apply updates to procedures and systems to enhance information systems security.


* Facilitate security awareness education and training for all users.


* Support Information Technology compliance initiatives to ensure adherence to all regulatory standards.


* Conduct research and r...