Cybersecurity Analyst, IT Compliance - Marathon Petroleum Corporation
San Antonio, TX
About the Job
An exciting career awaits you
At MPC, we’re committed to being a great place to work – one that welcomes new ideas, encourages diverse perspectives, develops our people, and fosters a collaborative team environment.
Position Summary
This is a position within the IT Compliance team which is part of the Cybersecurity Governance, Risk, and Compliance organization. The successful candidate should be knowledgeable of PCI DSS compliance, SOX IT compliance, and general IT compliance and control concepts. The candidate will be responsible for executing activities that support the larger IT processes and control environments. This position works with business partners including IT, process owners, and internal/external audit groups to ensure appropriate implementation and representation of control practices and postures.
This position belongs to a family of jobs with increasing responsibility, competency, and skill level. Actual position title and pay grade will be based on the selected candidate’s experience and qualifications.
Key Responsibilities
+ Conducts controls analysis of IT business process and systems, reports impact of changes and additions to security systems, and executes activities related to IT processes and control environments to ensure controls are designed and operating effectively.
+ Assists with the resolution of routine multi-functional technical issues, prepares and presents cybersecurity assessments along with associated risks, and continuously assesses and improves IT control frameworks and compliance processes to enhance efficiency, reduce risks, and meet evolving requirements.
+ Evaluates the efficiency and effectiveness of security processes and controls to ensure confidentiality, integrity, and availability of data, while ensuring compliance with PCI DSS, IT SOX, and other relevant frameworks by monitoring, assessing, and improving IT compliance controls, under the guidance of senior colleagues.
+ Recommends or executes remediation measures and develops cost estimates for mitigation strategies. Monitors networks, systems, and applications for potential cybersecurity incidents, investigates and analyzes their nature and scope, and identifies compliance gaps. Collaborates with stakeholders to develop appropriate remediation strategies.
+ Analyzes security protocols, compliance reviews, administers and maintains security audits and reports of server access and activity; participates in disaster recovery planning per corporate guidelines.
+ Delivers and implements global security initiatives, policies, and compliance requirements while maintaining clear and accurate documentation of compliance activities. Collaborates with IT and security engineers to generate cybersecurity metrics and prepare reports for management, auditors, and stakeholders as needed.
+ Collaborates to improve metric outcomes and provides cybersecurity consulting, guidance, and support to customers and stakeholders. Acts as a liaison between IT, process owners, and internal/external audit groups to support audits, assessments, and compliance testing.
+ Effectively communicates emerging Information Technology/Operations Technology and cybersecurity technology trends as well as their impact on the security landscape.
Education and Experience
+ Bachelor’s degree in information technology, related field or equivalent experience.
+ Professional certification, e.g. Security+, Network+, OSCP, GIAC, CEH preferred.
+ 2 years of relevant experience required.
+ Experience in direct support of PCI and/or IT SOX compliance required.
+ Experience with IT general controls, frameworks, and compliance assessment practices required.
Skills
Authentic Communicator -Expresses ideas and information, both verbally and in writing, clearly and credibly. Listens to understand and fosters constructive dialogue.
Cybersecurity Risk Management - The process of developing cyber risk assessment and treatment techniques that can effectively pre-empt and identify significant security loopholes and weaknesses, demonstrating the business risks associated with these loopholes and providing risk treatment and prioritization strategies to effectively address the cyber-related risks, threats and vulnerabilities, ensuring appropriate levels of protection, confidentiality, integrity and privacy in alignment with the security framework.
General Programming - Applies a computer language to communicate with computers using a set of instructions and to automate the execution of tasks.
Intrusion Detection - The use of security analytics, including the outputs from intelligence analysis, predictive research and root cause analysis in order to search for and detect potential breaches or identify recognized indicators and warnings. Also, monitoring and collating external vulnerability reports for organizational relevance, ensuring that relevant vulnerabilities are rectified through formal change processes.
Penetration Testing - The practice of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. Penetration testing can be automated with software applications or performed manually.
Security Controls - Manages and maintains an information system that focus on the management of risk and the management of information systems security.
Security Governance - The process of developing and disseminating corporate security policies, frameworks and guidelines to ensure that day-to-day business operations are guarded and well protected against risks, threats and vulnerabilities.
Security Information & Event Management (SIEM) - A set of tools and services offering real-time visibility across an organization's information security systems, and event log management that consolidates data from numerous sources.
Security Policy Management - The process of identifying, implementing, and managing the rules and procedures that all individuals must follow when accessing and using an organization's IT assets and resources.
Threat Analysis - Monitor intelligence-gathering and anticipate potential threats to an IT/OT systems proactively. This involves the pre-emptive analysis of potential perpetrators, anomalous activities and evidence-based knowledge and
inferences on perpetrators' motivations and tactics.
Threat Hunting - Searches through networks, endpoints, and datasets to detect and isolate cyber threats that evade existing security solutions.
Vulnerability Management - The process of defining, identifying, classifying and prioritizing vulnerabilities in computer systems, applications and network infrastructures and providing the organization with the necessary knowledge, awareness and risk background to understand the threats to its business.
As an energy industry leader, our career opportunities fuel personal and professional growth.
Location:
San Antonio, Texas
Additional locations:
Findlay, Ohio
Job Requisition ID:
00013841
Location Address:
19100 Ridgewood Pkwy
Education:
Employee Group:
Full time
Employee Subgroup:
Regular
Marathon Petroleum Company LP is an Equal Opportunity Employer and gives consideration for employment to qualified applicants without discrimination on the basis of race, color, religion, creed, sex, gender (including pregnancy, childbirth, breastfeeding or related medical conditions), sexual orientation, gender identity, gender expression, reproductive health decision-making, age, mental or physical disability, medical condition or AIDS/HIV status, ancestry, national origin, genetic information, military, veteran status, marital status, citizenship or any other status protected by applicable federal, state, or local laws. If you would like more information about your EEO rights as an applicant, click here (https://marathonpetroleum.brandextract.com/staged/marathonpetroleum.com/content/documents/Jobs_/Department_of_Labor_EEOC_.pdf) . If you need a reasonable accommodation for any part of the application process at Marathon Petroleum LP, please contact our Human Resources Department at talentacquisition@marathonpetroleum.com . Please specify the reasonable accommodation you are requesting, along with the job posting number in which you may be interested. A Human Resources representative will review your request and contact you to discuss a reasonable accommodation. Marathon Petroleum offers a total rewards program which includes, but is not limited to, access to health, vision, and dental insurance, paid time off, 401k matching program, paid parental leave, and educational reimbursement. Detailed benefit information is available at https://mympcbenefits.com .The hired candidate will also be eligible for a discretionary company-sponsored annual bonus program. Equal Opportunity Employer: Veteran / Disability
We will consider all qualified Applicants for employment, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws. In reviewing criminal history in connection with a conditional offer of employment, Marathon will consider the key responsibilities of the role.
About Marathon Petroleum Corporation
Marathon Petroleum Corporation (MPC) is a leading, integrated, downstream energy company headquartered in Findlay, Ohio. The company operates the nation's largest refining system. MPC's marketing system includes branded locations across the United States, including Marathon brand retail outlets. MPC also owns the general partner and majority limited partner interest in MPLX LP, a midstream company that owns and operates gathering, processing, and fractionation assets, as well as crude oil and light product transportation and logistics infrastructure.
At MPC, we’re committed to being a great place to work – one that welcomes new ideas, encourages diverse perspectives, develops our people, and fosters a collaborative team environment.
Position Summary
This is a position within the IT Compliance team which is part of the Cybersecurity Governance, Risk, and Compliance organization. The successful candidate should be knowledgeable of PCI DSS compliance, SOX IT compliance, and general IT compliance and control concepts. The candidate will be responsible for executing activities that support the larger IT processes and control environments. This position works with business partners including IT, process owners, and internal/external audit groups to ensure appropriate implementation and representation of control practices and postures.
This position belongs to a family of jobs with increasing responsibility, competency, and skill level. Actual position title and pay grade will be based on the selected candidate’s experience and qualifications.
Key Responsibilities
+ Conducts controls analysis of IT business process and systems, reports impact of changes and additions to security systems, and executes activities related to IT processes and control environments to ensure controls are designed and operating effectively.
+ Assists with the resolution of routine multi-functional technical issues, prepares and presents cybersecurity assessments along with associated risks, and continuously assesses and improves IT control frameworks and compliance processes to enhance efficiency, reduce risks, and meet evolving requirements.
+ Evaluates the efficiency and effectiveness of security processes and controls to ensure confidentiality, integrity, and availability of data, while ensuring compliance with PCI DSS, IT SOX, and other relevant frameworks by monitoring, assessing, and improving IT compliance controls, under the guidance of senior colleagues.
+ Recommends or executes remediation measures and develops cost estimates for mitigation strategies. Monitors networks, systems, and applications for potential cybersecurity incidents, investigates and analyzes their nature and scope, and identifies compliance gaps. Collaborates with stakeholders to develop appropriate remediation strategies.
+ Analyzes security protocols, compliance reviews, administers and maintains security audits and reports of server access and activity; participates in disaster recovery planning per corporate guidelines.
+ Delivers and implements global security initiatives, policies, and compliance requirements while maintaining clear and accurate documentation of compliance activities. Collaborates with IT and security engineers to generate cybersecurity metrics and prepare reports for management, auditors, and stakeholders as needed.
+ Collaborates to improve metric outcomes and provides cybersecurity consulting, guidance, and support to customers and stakeholders. Acts as a liaison between IT, process owners, and internal/external audit groups to support audits, assessments, and compliance testing.
+ Effectively communicates emerging Information Technology/Operations Technology and cybersecurity technology trends as well as their impact on the security landscape.
Education and Experience
+ Bachelor’s degree in information technology, related field or equivalent experience.
+ Professional certification, e.g. Security+, Network+, OSCP, GIAC, CEH preferred.
+ 2 years of relevant experience required.
+ Experience in direct support of PCI and/or IT SOX compliance required.
+ Experience with IT general controls, frameworks, and compliance assessment practices required.
Skills
Authentic Communicator -Expresses ideas and information, both verbally and in writing, clearly and credibly. Listens to understand and fosters constructive dialogue.
Cybersecurity Risk Management - The process of developing cyber risk assessment and treatment techniques that can effectively pre-empt and identify significant security loopholes and weaknesses, demonstrating the business risks associated with these loopholes and providing risk treatment and prioritization strategies to effectively address the cyber-related risks, threats and vulnerabilities, ensuring appropriate levels of protection, confidentiality, integrity and privacy in alignment with the security framework.
General Programming - Applies a computer language to communicate with computers using a set of instructions and to automate the execution of tasks.
Intrusion Detection - The use of security analytics, including the outputs from intelligence analysis, predictive research and root cause analysis in order to search for and detect potential breaches or identify recognized indicators and warnings. Also, monitoring and collating external vulnerability reports for organizational relevance, ensuring that relevant vulnerabilities are rectified through formal change processes.
Penetration Testing - The practice of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. Penetration testing can be automated with software applications or performed manually.
Security Controls - Manages and maintains an information system that focus on the management of risk and the management of information systems security.
Security Governance - The process of developing and disseminating corporate security policies, frameworks and guidelines to ensure that day-to-day business operations are guarded and well protected against risks, threats and vulnerabilities.
Security Information & Event Management (SIEM) - A set of tools and services offering real-time visibility across an organization's information security systems, and event log management that consolidates data from numerous sources.
Security Policy Management - The process of identifying, implementing, and managing the rules and procedures that all individuals must follow when accessing and using an organization's IT assets and resources.
Threat Analysis - Monitor intelligence-gathering and anticipate potential threats to an IT/OT systems proactively. This involves the pre-emptive analysis of potential perpetrators, anomalous activities and evidence-based knowledge and
inferences on perpetrators' motivations and tactics.
Threat Hunting - Searches through networks, endpoints, and datasets to detect and isolate cyber threats that evade existing security solutions.
Vulnerability Management - The process of defining, identifying, classifying and prioritizing vulnerabilities in computer systems, applications and network infrastructures and providing the organization with the necessary knowledge, awareness and risk background to understand the threats to its business.
As an energy industry leader, our career opportunities fuel personal and professional growth.
Location:
San Antonio, Texas
Additional locations:
Findlay, Ohio
Job Requisition ID:
00013841
Location Address:
19100 Ridgewood Pkwy
Education:
Employee Group:
Full time
Employee Subgroup:
Regular
Marathon Petroleum Company LP is an Equal Opportunity Employer and gives consideration for employment to qualified applicants without discrimination on the basis of race, color, religion, creed, sex, gender (including pregnancy, childbirth, breastfeeding or related medical conditions), sexual orientation, gender identity, gender expression, reproductive health decision-making, age, mental or physical disability, medical condition or AIDS/HIV status, ancestry, national origin, genetic information, military, veteran status, marital status, citizenship or any other status protected by applicable federal, state, or local laws. If you would like more information about your EEO rights as an applicant, click here (https://marathonpetroleum.brandextract.com/staged/marathonpetroleum.com/content/documents/Jobs_/Department_of_Labor_EEOC_.pdf) . If you need a reasonable accommodation for any part of the application process at Marathon Petroleum LP, please contact our Human Resources Department at talentacquisition@marathonpetroleum.com . Please specify the reasonable accommodation you are requesting, along with the job posting number in which you may be interested. A Human Resources representative will review your request and contact you to discuss a reasonable accommodation. Marathon Petroleum offers a total rewards program which includes, but is not limited to, access to health, vision, and dental insurance, paid time off, 401k matching program, paid parental leave, and educational reimbursement. Detailed benefit information is available at https://mympcbenefits.com .The hired candidate will also be eligible for a discretionary company-sponsored annual bonus program. Equal Opportunity Employer: Veteran / Disability
We will consider all qualified Applicants for employment, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws. In reviewing criminal history in connection with a conditional offer of employment, Marathon will consider the key responsibilities of the role.
About Marathon Petroleum Corporation
Marathon Petroleum Corporation (MPC) is a leading, integrated, downstream energy company headquartered in Findlay, Ohio. The company operates the nation's largest refining system. MPC's marketing system includes branded locations across the United States, including Marathon brand retail outlets. MPC also owns the general partner and majority limited partner interest in MPLX LP, a midstream company that owns and operates gathering, processing, and fractionation assets, as well as crude oil and light product transportation and logistics infrastructure.
Source : Marathon Petroleum Corporation
