Senior Cyber Assessment Analyst

Senior Cyber Assessment Analyst 

NiSource's Cyber Assessments program, also known as Third Party Risk Management leverages Fortress and Archer to support the vendor risk lifecycle. We communicate results to management, supply chain, and vendor relationship owners. The Cyber Assessments program also partners with Supply Chain and Cyber Vulnerability Management for a cohesive Fortress implementation, including Supply Chain vendor onboarding and contract renewal processes. Cyber Assessments include corporate and technology Control Assessments using Fortress and coordinating independent assessments such as penetration tests, NIST CSF, and mock regulatory reviews.  Technology supports focuses on our enterprise Archer implementation and Fortress solution.  The Cyber Assessments Analyst will work collaboratively with numerous teams including NERC CIP Compliance, Pipeline Compliance, Innovation, Supply Chain and the business.  This role is responsible for executing the Cyber Assessment program and driving the effective use of Fortress and Archer, including upgrades, dashboards and metrics.  You will work closely with the Director of Cyber Compliance, the Manager Cyber Assessments, the Manager(s) Cyber Compliance, and others as needed to ensure that all assessment results are addressed and leverages Fortress and Archer and their adoption. 

Key outcomes for success include: 

• NiSource has an effective Cyber Assessments program, leveraging Fortress and reducing vendor risk 

• The program must effectively communicate results to management, vendor relationship owners, and supply chain

• NiSource Cyber Assessments partners with Supply Chain and Cyber Vulnerability Management for a cohesive Fortress implementation, including Supply Chain vendor onboarding and contract renewal processes

• Archer is an effective tool for Innovation, Cyber Compliance and expands to additional business units.  Interfaces with key NiSource systems of record (i.e. Workday, Service Now, etc.)

• Analyze vendor risk posture, identify risk items, tracking of exceptions, and other data to assist management in making more informed decisions relative to vendor management

• Help ensure that NiSource and contracted services are performed to satisfaction

• Positive business perception of Cyber Assessments services through proactive actions

Essential Responsibilities:

• Perform routine assignments in the Cyber Assessment Analyst job band, under the direction of the Director of Cyber and the Manager Cyber Assessments

• Work closely with the business, OT, IT, and Cyber and Service Providers to perform and/or support Cyber Assessment processes

• Assist in driving the implementation of the roadmaps for Cyber Assessments, Archer, and Fortress Control Assessments

• Assist in executing the Cyber Assessment (CA) program, ensuring a methodology is used and communicated relative to when a CA is performed, risks are mitigated, results are communicated, and metrics are produced supporting the program. 

• Executes or assists others in executing Cyber assessments supporting the business, Cyber, IT, OT, and the Innovation line of business ensuring Supply Chain processes are adhered to.  Reviews must meet stated objectives, budget requirements, timeline requirements and reporting/readout requirements

• Supports and strives to be knowledgeable relative to Fortress Control Assessments, contributing to the direction of the product, our leveraging of the tool, and the ongoing business benefit to NiSource

• Supports and strives to be knowledgeable relative to Archer, contributing to the direction of the product, our leveraging of the tool, and the ongoing business benefit to NiSource; Serves as an Archer ambassador across NiSource as to capabilities and expanded adoption

• Assist in audit/issues tracking and resolution for processes related to Cyber Assessments as requested

• Advance the use and adoption of Archer RSA to maintain and manage risk, compliance, and policy monitoring and tracking

You must possess the below minimum qualifications to be initially considered for this position. Preferred qualifications are in addition to the minimum requirements and are considered a plus factor in identifying top candidates.

Minimum Qualifications

• Bachelor’s Degree or equivalent work experience

• 4+ years of experience in varying Third Party Risk Management functions

• 4+ years of experience with Vendor Control Assessments, SOC2 reports and metrics

• Knowledge of IT infrastructure components, trends, and best practices.