Manager, CIP Compliance

NORTHEAST POWER COORDINATING•New York, NY

9d•$160,000 - $180,000•Remote

About The Position

Under the direction of the Director of Compliance Monitoring, the Manager, CIP Compliance leads and oversees Critical Infrastructure Protection (CIP) compliance monitoring activities within NPCC's Compliance Monitoring and Enforcement Program (CMEP). The role manages CIP compliance monitoring engagements, supervises staff, supports risk-based compliance monitoring initiatives, and builds relationships with Registered Entities and ERO Enterprise stakeholders. The Manager assists with developing and implementing compliance monitoring strategies and programs, oversees the performance and quality of CIP compliance monitoring activities, and ensures engagements comply with NERC Rules of Procedure, NPCC CMEP processes, and applicable Canadian provincial agreements. The position also supports annual planning, analyzes risks and compliance trends, develops staff, and represents NPCC in industry initiatives.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or a related technical field, plus ten or more years of relevant industry experience; or an equivalent combination of education and experience demonstrating ability to perform the essential functions.
Minimum ten years of experience in the electric utility industry or a related technical field.
Experience in desktop and systems design; evaluating compliance programs, internal controls, risk mitigation practices, or governance processes associated with NERC Reliability Standards; or analyzing compliance monitoring results, identifying trends, and developing recommendations and reports.
Strong leadership, supervisory, coaching, and mentoring skills.
Ability to lead cross-functional teams and manage complex compliance monitoring engagements.
Ability to exercise sound professional judgment in complex or sensitive compliance matters.
Strong analytical, problem-solving, and critical-thinking skills.
Excellent verbal, written, and presentation skills, including ability to communicate technical and regulatory concepts to executive, technical, and non-technical audiences.
Excellent interpersonal, relationship-building, and conflict-resolution skills.
Strong project management, organizational, and prioritization skills, including ability to manage multiple projects and competing priorities in a dynamic regulatory environment.
Ability to engage and collaborate effectively with internal and external stakeholders.
Ability to develop and deliver professional presentations and training programs.
Strong attention to detail and commitment to quality, teamwork, and collaboration.
Advanced proficiency with Microsoft Office applications, including Word, Excel, PowerPoint, Outlook, and Teams.
Ability to participate in and lead virtual teams.
Demonstrated sound judgment, professionalism, and commitment to integrity, confidentiality, and ethical conduct.
Ability to work and travel within the U.S. and travel to Canada.

Nice To Haves

Master's degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or a related field.
Experience managing compliance monitoring activities conducted under delegated regulatory authority.
Experience with Canadian provincial reliability agreements, Memoranda of Understanding, or cross-border regulatory frameworks.
Experience implementing risk-based compliance monitoring programs and evaluating internal controls.
Proficiency in the NP-View network analysis tool.
Experience participating in ERO Enterprise working groups, committees, task forces, or industry initiatives.
Experience developing strategic plans, departmental budgets, performance metrics, and organizational goals.
Experience with risk-based compliance monitoring methodologies.
Experience evaluating and testing compliance-related internal controls.
Experience serving on ERO Enterprise task forces, working groups, standards drafting teams, or industry committees.
Relevant professional certification or license, such as CISSP, CISA, CISM, GIAC Critical Infrastructure Protection (GCIP), PMP, or CIA.

Responsibilities

Establish, maintain, and continually improve processes and procedures for CIP Compliance Audits, Self-Certifications, Spot Checks, and other compliance monitoring activities.
Review and update compliance monitoring processes to reflect changes to NERC Rules of Procedure, CMEP guidance, FERC Orders, Canadian agreements, emerging risks, and ERO Enterprise initiatives.
Support risk-based compliance monitoring by evaluating entity risks, internal controls, compliance history, and other relevant indicators.
Assist with developing and executing annual compliance monitoring plans, strategies, and program initiatives.
Support the Director of Compliance Monitoring with compliance monitoring documentation, records, metrics, and key performance indicators.
Manage CIP compliance monitoring engagements across the United States and Canada in accordance with applicable rules, programs, and agreements.
Serve as Audit Team Lead for assigned engagements, directing audit activities, coordinating resources, facilitating team discussions, reviewing work products, and ensuring quality and consistency.
Assist in developing engagement scopes using risk-informed considerations, including inherent risk assessments, internal controls, and compliance history.
Review audit workpapers, engagement documentation, reports, and other deliverables for accuracy, consistency, quality, and adherence to NPCC and ERO Enterprise expectations.
Ensure engagements meet established timelines and milestones, including notifications, evidence submissions, interviews, site visits, report development, entity comment periods, and final report issuance.
Identify CIP compliance trends, emerging risks, and industry developments and contribute to lessons learned, outreach materials, and analytical reports.
Maintain knowledge of NERC Rules of Procedure, Reliability Standards, standards under development, and related industry initiatives.
Supervise, coach, and develop staff through performance management, mentoring, technical guidance, and professional development.
Monitor staff performance and support employee growth through training, succession planning, and continuous development initiatives.
Support recruitment and hiring, including candidate sourcing, interviewing, selection, and onboarding.
Develop and maintain working relationships with Registered Entities, NERC, Regional Entities, and other industry stakeholders.
Facilitate discussions with Registered Entities concerning audit scope, evidence requests, internal controls, results, and continuous improvement opportunities.
Ensure staff adhere to NPCC policies and procedures, including antitrust, conflict of interest, confidentiality, and professional conduct requirements.
Develop and deliver training, education, outreach, and communications to NPCC staff, Registered Entities, and ERO Enterprise personnel.
Represent NPCC on ERO Enterprise committees, task forces, working groups, and special projects.
Perform other duties and special projects as assigned.