Senior IT Security Specialist (Security Governance)

The Senior IT Security Specialist provides a wide range of information security services to protect the confidentiality, integrity, and availability of NYISO information and technical environments and to support NYISO's enterprise security goals and objectives. Responsibilities vary by function, and security operations, threat management, security incident response, security event monitoring and analysis, vulnerability management, engineering and operation of security tools and infrastructure, access, identity & account management, risk management, supply chain cyber risk management, information protection, development and maintenance of security policies, standards, and procedures, and the delivery of effective security awareness training. The Senior IT Security Specialist evaluates existing NYISO security measures, assesses the effectiveness of those measures, and recommends changes that will improve all aspects of NYISO security. The Senior IT Security Specialist is responsible for ensuring compliance with corporate and regulatory standards and plays a key role in ensuring the NYISO's compliance with cyber risk frameworks and standards.

ESSENTIAL DUTIES and RESPONSIBILITIES

• Serves as subject matter expert on NERC CIP standards and requirements and provides expertise on implementation of the CIP requirements through security platforms, technologies, controls, and processes.
• Performs investigations of instances of potential non-compliance with NERC CIP standards, presents recommendations to senior leaders and other stakeholders, and communicates with regulatory bodies and authorities as warranted.
• Performs cyber risk assessments on vendors, cloud services, and other external entities and makes recommendations based on cyber risk.
• Develops and supports solutions that protect NYISO data and information based on classification and NYISO data policies.
• Performs formal risk management functions including oversight of a cyber risk register.
• Establishes a controls testing program and performs ongoing oversight and governance of security controls to ensure their effectiveness, performance, and availability.
• Manages cyber risks introduced through trusted external relationships through controls, contract language, policies, and procedures that enforce good security practices with vendors and other external partners.
• Represent the NYISO to a wide range of external organizations at industry events, seminars, and conferences. Present and speak on security and compliance as appropriate. Interact with market participants, government, and other external entities on behalf of the NYISO.
• Lead the implementation of processes, such as GRC (governance, risk and compliance), to automate and continuously monitor information security controls, exceptions, risks, testing. Develops reporting metrics, dashboards, and evidence artifacts.

QUALIFICATIONS:

• Bachelor's Degree (BS) in Information Security, Computer Science, Computer Information Systems, or similar fields. Master's Degree (MS, MBA) preferred.
• At least seven years of experience in progressively responsible information technology and/or IT security positions is required, along with an in-depth understanding of information security best practices, and expertise with related security technologies and tools.
• Broad and deep expertise in different information security technologies, as well as a conceptual knowledge of system development lifecycles, code and application vulnerabilities, and ability to identify solutions to challenging technical problems.
• Experience with complex IT infrastructure systems is preferred.
• Experience in the energy sector is desirable.
• High level of personal integrity, and the ability to professionally handle confidential matters and exude the appropriate level of judgment and maturity.
• Ability to respond to common inquiries or complaints from market participants, regulatory agencies or members of the business community.
• Ability to read, analyze and interpret general business periodicals, professional journals, technical procedures, and governmental regulations.
• Ability to write reports, business correspondence, and procedure manuals.
• Ability to write presentations and articles for publication that conform to prescribed style and format.
• Ability to effectively communicate security and risk-related concepts to technical and nontechnical audiences.
• Ability to interpret an extensive variety of technical instructions in mathematical or diagram form and deal with several abstract and concrete variables.
• GIAC, CISA, CEH, CFE, CISSP, or similar certification preferred.
• Secret Clearance or above preferred.
• Knowledge of NIST Special Publication 800 Series is preferred.

ADDITIONAL REQUIREMENTS

• Ability to read, analyze and interpret general business periodicals, professional journals, technical procedures, and governmental regulations. Ability to write reports, business correspondence, and procedure manuals. Ability to write presentations and articles for publication that conform to prescribed style and format. Ability to effectively communicate security and risk-related concepts to technical and nontechnical
• Ability to add, subtract, multiply and divide in all units of measure, using whole numbers, common fractions and decimals. Ability to compute rate, ratio and percent and to draw and interpret bar graphs.
• Ability to define problems, collect data, establish facts and draw valid conclusions. Ability to interpret an extensive variety of technical instructions in mathematical or diagram form and deal with several abstract and concrete
• Proficient with personal computers running the Windows operating system; experience with productivity software such as Microsoft Office applications, e-mail, and Internet

PHYSICAL DEMANDS

While performing the duties of this job, the employee is regularly required to talk or hear. The employee frequently is required to stand, walk, sit and use hands to perform routine office tasks. The employee is occasionally required to reach with hands and arms. The employee must occasionally lift and/or move up to 15 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

WORK ENVIRONMENT

The noise level in the work environment is usually moderate. Contact with staff and public will occur. Travel may be required to attend and/or conduct meetings, conferences and training. This position may require work on nights, weekends or holidays.

The NYISO takes pride in recruiting, developing and retaining highly talented individuals. In addition to competitive salaries, we offer a comprehensive benefits package and innovative reward programs.

The NYISO offers the flexibility to work both in the office and remotely, providing our employees with an enhanced work life balance. While the majority of the responsibilities of this role can be performed remotely, in most cases, employees will have periodic on-site requirements based on business needs.

All offers of employment will be made contingent upon the successful completion of a drug screening and background check.

The NYISO is an Equal Opportunity Employer and as such, does not discriminate in its hiring or employment practices.