Manager, Critical Infrastructure Protection

NRG•Houston, TX

1d•Remote

About The Position

The Manager of Critical Infrastructure Protection (CIP) has primary responsibility for CIP compliance at High and Medium Facilities and shared responsibility for cybersecurity and compliance for NRG Control Center and generation control systems. The manager leads a team responsible for administrative and technical performance across enterprise CIP standards and High and Medium Facilities. The role leads NERC CIP compliance activities and assigned standards, including asset classification, policy and procedure maintenance, access management, control execution, evidence preparation, and audit readiness. It also leads implementation and continual improvement of operational technology (OT) cybersecurity initiatives and the CIP workflow automation application. The manager identifies compliance and cybersecurity gaps, supports investigation and remediation, and promotes team development, knowledge sharing, and program resilience. The position is primarily work from home, with work in an open office environment up to 1–2 days per week as required. Travel may be up to 25%, and some overtime is required when special projects arise.

Requirements

At least 3 years of experience developing, administering, or managing a NERC CIP compliance program.
Demonstrated experience developing RSAWs, preparing audit evidence, and supporting or leading NERC CIP audits.
Previous management or leadership experience, including responsibility for team development, performance, and execution of compliance or cybersecurity objectives.
Working knowledge of security, industrial controls, networking concepts, and security tools.
Ability to communicate verbally and in writing with internal and external customers at all levels.
Demonstrated presentation, development, and project management skills.
Ability to work independently and as a team member.
Ability to set priorities and respond to changing demands from multiple sources.
Ability to exercise discretion and independent judgment in applying established techniques, procedures, or standards.
Demonstrated analytical and problem-solving skills.

Nice To Haves

Bachelor's degree in Computer Science, Cybersecurity, Engineering, Management Information Systems, Information Technology, or a related technical field; equivalent relevant experience may be considered.
Relevant cybersecurity, OT/ICS security, or compliance certification, such as CISSP, GCIP, GICSP, CISA, or equivalent.
5 to 8 years of experience in NERC CIP compliance, OT/ICS cybersecurity, power generation control systems, or IT/OT network infrastructure.
Working knowledge of industrial control systems, plant control equipment, network architecture, cybersecurity controls, and operational requirements of power generation environments.
Experience supporting or leading NERC CIP compliance activities, regulatory audits, evidence development, remediation activities, and implementation of compliance controls.

Responsibilities

Provide leadership, direction, and mentoring to the CIP Team to support performance, operational efficiency, knowledge development, and personnel growth.
Lead NERC CIP compliance activities, including asset classification, policy and procedure development and maintenance, access management, and administrative compliance functions.
Serve as a responsible owner for assigned NERC CIP Standards and oversee enterprise compliance activities supporting CIP systems and High and Medium Impact BES Cyber Systems.
Lead implementation and continuous improvement of OT cybersecurity initiatives, technologies, and controls.
Lead implementation, administration, and continual improvement of the CIP workflow automation application.
Oversee subject matter experts' execution of assigned NERC CIP controls, track deliverables, and review RSAW responses and supporting evidence for compliance and audit readiness.
Support development of self-reports, Requests for Information (RFIs), Technical Feasibility Exceptions (TFEs), mitigation plans, and evidence supporting mitigation completion.
Identify compliance, cybersecurity, and process improvement opportunities and lead initiatives to address control gaps and improve CIP program effectiveness and efficiency.
Promote cross-training and knowledge sharing across the CIP Team.
Identify and escalate potential NERC CIP violations, near misses, and compliance concerns; support root cause analysis, corrective action development, and validation of deficiencies.