Senior OT Cybersecurity Specialist - NERC CIP

Your impact

As a Senior OT Cybersecurity Specialist with a strong focus on NERC Critical Infrastructure Protection (CIP), you will help protect the operational technology and cyber assets that support reliable electric generation and critical power operations. You will translate regulatory obligations into practical, sustainable controls that work in live plant environments. Working across cybersecurity, operations, engineering, compliance, and vendor teams, you will strengthen cyber resilience while helping the organization remain audit-ready and operationally effective.

Responsibilities

Own and support day-to-day NERC CIP compliance activities across applicable standards, including BES Cyber System identification and categorization, security management controls, personnel and training, electronic and physical access, system security management, incident response, recovery, configuration management, vulnerability assessments, information protection, communications, and supply chain risk management.

Maintain accurate inventories and classifications of BES Cyber Systems, BES Cyber Assets, Electronic Access Control or Monitoring Systems, Physical Access Control Systems, Protected Cyber Assets, and related infrastructure.

Develop, implement, and maintain NERC CIP policies, procedures, technical standards, control narratives, and evidence packages that are clear, repeatable, and aligned with actual operating practices.

Coordinate recurring compliance activities such as access reviews, account management, patch evaluations, malicious code prevention, security event monitoring, ports and services reviews, backup and recovery testing, vulnerability assessments, and change-control evidence.

Prepare for and support internal assessments, mock audits, spot checks, self-certifications, data requests, and regulatory audits; organize evidence, validate completeness, identify gaps, and track corrective actions to closure.

Partner with plant operations, controls, electrical engineering, IT, legal, physical security, and compliance personnel to resolve findings without creating unnecessary operational risk.

Perform OT cybersecurity risk assessments and design reviews for control systems, generation assets, plant networks, remote access, vendor connections, and new projects or modifications.

Apply secure architecture and defense-in-depth practices to industrial environments, including network segmentation, firewalls, jump hosts, identity and access management, logging, time synchronization, endpoint controls, backup, recovery, and secure remote access.

Support cybersecurity incident response and recovery exercises involving operational technology and applicable NERC CIP reporting, escalation, evidence preservation, and lessons learned.

Evaluate vendors and service providers for cybersecurity and NERC CIP supply chain risk; document security requirements and support contract, procurement, and remote-access reviews.

Monitor changes to NERC CIP standards, implementation plans, guidance, and enforcement trends; assess organizational impact and help plan timely implementation, including emerging internal network security monitoring requirements.

Mentor technical and compliance stakeholders, deliver role-based training, and promote a culture of respectful collaboration, accountability, and continuous improvement.