Manager, Critical Infrastructure Protection

Job Summary:

The Manager of Critical Infrastructure Protection (CIP) has primary responsibility for CIP compliance at High and Medium Facilities and shared responsibility for cyber security and compliance for all NRG Control Center and generation control systems.  The Manager has direct reports which cover administrative and technical performance all CIP standards at the enterprise level as well as the High and Medium Facilities.

Essential Duties/Responsibilities:

• Provide leadership, direction, and mentoring to the CIP Team to support team performance, operational efficiency, knowledge development, and personnel growth.
• Lead NERC CIP compliance activities, including asset classification, policy and procedure development and maintenance, access management, and other administrative compliance functions.
• Serve as a responsible owner for assigned NERC CIP Standards and oversee enterprise compliance activities supporting CIP systems and High and Medium Impact BES Cyber Systems.
• Lead the implementation and continuous improvement of OT cybersecurity initiatives, technologies, and controls to strengthen the security and resilience of operational technology environments.
• Lead the implementation, administration, and continual improvement of the CIP workflow automation application to improve compliance execution, documentation, and reporting.
• Oversee SME execution of assigned NERC CIP controls, including tracking deliverables and reviewing RSAW responses and supporting evidence to ensure compliance and audit readiness.
• Support CIP management, specialists, and SMEs in the development of self-reports, Requests for Information (RFIs), Technical Feasibility Exceptions (TFEs), mitigation plans, and evidence supporting mitigation completion.
• Identify compliance, cybersecurity, and process improvement opportunities and lead initiatives to address control gaps and improve the effectiveness and efficiency of the CIP program.
• Promote cross-training and knowledge sharing across the CIP Team to strengthen program resiliency and continuity.
• Identify and escalate potential NERC CIP violations, near misses, and compliance concerns, and support root cause analysis, corrective action development, and validation of identified deficiencies.

Working Conditions:

• Primarily work from home
• Open office environment up to 1-2 days per week as required
• Some overtime is required as special projects arise.
• Travel up to 25%

Minimum Requirements:

• Minimum of 3 years of experience developing, administering, or managing a NERC CIP compliance program.
• Demonstrated experience developing RSAWs, preparing audit evidence, and supporting or leading NERC CIP audits.
• Previous management or leadership experience, including responsibility for team development, performance, and execution of compliance or cybersecurity objectives.

Preferred Qualifications:

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Management Information Systems, Information Technology, or a related technical field. Equivalent relevant experience may be considered.
• Relevant cybersecurity, OT/ICS security, or compliance certification preferred, such as CISSP, GCIP, GICSP, CISA, or equivalent.
• 5 to 8 years of experience in NERC CIP compliance, OT/ICS cybersecurity, power generation control systems, or IT/OT network infrastructure.
• Working knowledge of industrial control systems, plant control equipment, network architecture, cybersecurity controls, and the operational requirements of power generation environments.
• Experience supporting or leading NERC CIP compliance activities, regulatory audits, evidence development, remediation activities, and implementation of compliance controls.

Additional Knowledge, Skills and Abilities:

• Working knowledge of security, industrial controls, and networking concepts and security tools
• Demonstrated ability to communicate (verbal and written) with all levels of internal and external customers.
• Demonstrated presentation and development skills
• Demonstrated project management skills.
• Demonstrated ability to work independently and as a team member.
• Demonstrated ability to set priorities and respond to changing demands from multiple sources.
• Ability to exercise discretion and independent judgment in applying established techniques, procedures, or standards.
• Demonstrated analytical and problem-solving skills.

Physical Requirements (Demand and Frequency):

• Occasionally requires lifting as appropriate to perform duties and responsibilities.