Director Cybersecurity Governance, Risk, & Compliance

Requisition: 82809

PSEG Company: PSEG Services Corp.

Salary Range: $ 157,000 - $ 257,600

Work Location Category: Hybrid Flexible

We’re one of the country’s largest energy companies, with a vision of powering a future where people use less energy, and it’s cleaner, safer and delivered more reliably than ever. We’re also deeply connected to the communities we serve, with more than 13,000 employees working together to support our customers and make a difference every day.

Here, you’ll have the stability and exciting opportunities that come with being a Fortune 500 company — along with a supportive, friendly work environment where your contributions are valued.

We know life isn’t one-size-fits-all, and neither is work. That’s why we offer flexible work options depending on the role.

In support of this model, roles have been categorized into one of three work location categories:

1. Onsite – roles where employees are expected to be onsite daily.

2. Hybrid fixed – roles that are a mix of remote work and onsite work fixed days each week

3. Hybrid flexible – roles that are a mix of remote work and onsite work, but the onsite requirements have greater flexibility. (i.e. 5-8 days a month vs. set days each week).

As an employee, if you are regularly scheduled to work 20 or more hours per week, you will have access to a wide range of comprehensive benefits from day one, designed to support your total well-being: medical, dental, vision, parental leave and family leave programs, behavioral health programs, 401(k) with company match, life insurance, tuition reimbursement, and generous paid time off.

More than 13,000 people already call PSEG their work home, taking pride in providing safe, reliable service to millions of customers. If you’re looking for a place where you can build a meaningful career and help power and support our communities, we’d love to welcome you to the team.

PSEG is not offering visa sponsorship for this position.

Job Summary

The Director, Cybersecurity Governance, Risk, and Compliance leads the development, implementation, and ongoing coordination of enterprise-wide Cybersecurity Governance, Risk, and Compliance, including Regulatory Assurance (e.g. NRC, SOX, DoE, NERC CIP, TSA, Internal Audits, etc.), Cybersecurity Risk, Cybersecurity Policy, Cybersecurity Awareness, and Nth Party Risk Management and Assurance. (S)he coordinates across all business lines, service departments, external risk organizations (e.g. cross-sector cyber industry trade organizations), and peer energy companies. As PSEG’s senior leader responsible for Cybersecurity Governance, Risk, and Compliance, (s)he will also be responsible for defining and aligning cybersecurity policies, strategy, and standards. (S)he will be responsible for multiple discrete projects/enhancements to build, maintain, and mature capabilities, including people, processes, and technologies. (S)he will engage across the entire IT, OT, and managed services landscapes, including leading a team across these environments.

(S)he will spend his/her time

- Serving as the Subject Matter Expert for Cybersecurity governance, risk, and compliance issues/concerns/audits.

- Conducting cybersecurity assessments, identifying risks, and tracking/reporting on remediations.

- Providing cybersecurity insight and expertise in assessing new business opportunities.

- Identifying opportunities for process improvements to deliver increasing efficiency within the Risk and Control framework.

- Interacting with auditors on cybersecurity management oversight.

- Coordinating with outside vendors/third-parties to protect client information, to secure data transmission protocols, and to complete/remediate Information/cybersecurity assessments.

- Collaborating closely with developers and infrastructure teams to implement the Cybersecurity policies required to protect the integrity, confidentiality, and availability of the information on an end-to-end basis.

- Implementing the risk assessment framework, which identifies critical cybersecurity and privacy impacting business process and/or systems.

- Maintaining the global Cybersecurity and IT risk registers, tracking remediations, and creating status reports/metrics.

- Completing risk assessments of new/existing infrastructure, systems, Industrial Control Systems, and other components.

- Conducting risk assessments of third-party vendors to evaluate cybersecurity controls for protecting company-specific data.

- Leading and/or contributing to the creation and maintenance of the enterprise’s cybersecurity documents (policies, standards, guidelines and procedures). Ensuring enforcement of these enterprise cybersecurity documents.

- Preparing for, supporting, and potentially presenting at, Cybersecurity Council, Senior Executive Team, and Board of Directors meetings.

- Preparing senior-level technical reports for executive management.

- Providing support and risk guidance for enterprise infrastructure, the wireless environment, Cloud software/infrastructure security, secure software development, and data protection.

- Collaborating closely with Digital Workplace, Infrastructure, Enterprise Resource Planning, and Application Development Teams to identify and remediate cybersecurity issues.

- Identifying/overseeing remediation of open cybersecurity issues and validating closure.

- Maintaining up-to-date cybersecurity knowledge, including awareness of innovative solutions/processes, emerging standards, and new threat vectors by reading professional publications, maintaining personal networks, and participating in professional organizations.

Job Responsibilities

- Directs, coaches, and counsels internal/external cyber resources on Cybersecurity technologies, including Regulatory Assurance (e.g. NRC, SOX, DoE, NERC CIP, TSA, Internal Audits, etc.), Cybersecurity Risk, Cybersecurity Policy, Cybersecurity Awareness, and Nth Party Risk Management and Assurance for all lines of business and service departments for both IT and OT landscapes. Ensure that Cybersecurity Governance, Risk, and Compliance service delivery aligns with the corporate IT strategy, including development of Cybersecurity operations standards, capacity planning, lifecycle management plans, solution selection, and partner management. Ensure scalability of Cybersecurity Governance, Risk, and Compliance capabilities, including hardware and software, to meet business needs and risk tolerances.

- Develops and implements best practices for PSEG Cybersecurity Governance, Risk, and Compliance capabilities. Participate in external risk organizations (including with peer groups) to learn from other organizations and to benchmark our program. Partner with professional Cybersecurity Governance, Risk, and Compliance associations, service providers, and to identify and implement best practices.

- Partners with and advises various IT teams. Operationalizes Policies, Practices, and Instructions to protect against existing and emerging threats.

- Builds relationships across PSEG business and technology teams. Interacts routinely with vendors, service providers, consultants/advisors, law enforcement agencies, and cross-sector cyber industry trade organizations. Ensures that cyber governance, risk, and compliance requirements are identified, well defined, properly documented, and approved by appropriate stakeholders.

- Develops, manages, and pre-prioritizes Cybersecurity CAPEX and OPEX budgets based on business needs and cyber threats. Lead the identification of optimal OPEX and CAPEX allocations, including opportunities to reduce expenditures while transforming PSEG Cybersecurity Governance, Risk, and Compliance. Lead and advise on business case development.

- Leads team, including performance evaluations, career development guidance, and other aspects to grow the talent pipeline and to mature our program.

Job Specific Qualifications

- Bachelors degree and 10 years of relevant cybersecurity experience, including leadership experience

- Demonstrated strong leadership and influence skills

- Demonstrated strong presentation skills with the ability to present to all levels of management and executive leadership

- Experience leading a Cybersecurity Governance, Risk, and Compliance organization

- Executive teamwork, facilitation, relationship building, and negotiation skills

- Ability to maintain positive working relationships both as a leader and as a team member

- Effective time management and multitasking skills

- Ability to communicate effectively with both technical and non-technical individuals

- Strong interpersonal communication skills, analytical abilities, detail focused, quality focused, and problem-solving skills, as well as broad knowledge of business functions, information technologies, and cybersecurity and compliance practice on a global level

- A demonstrated ability to develop and maintain policy that integrates various cybersecurity, network and data protection technologies and controls into a cohesive solution that sufficiently mitigates risk

- Extensive relevant experience in Cybersecurity, Information Risk Management, Nth-Party Risk Management, Cybersecurity Policies/Procedures, and Cybersecurity Compliance/Audit

- Strong analytical skills, problem solving skills, writing skills, attention to detail, and conceptual thinking, including the ability to work with technical and non-technical business owners

- Broad knowledge of cybersecurity principles (e.g. access control, data protection, security architecture, infrastructure/application security design principles, policies) and privacy (i.e. GDPR)

- Working knowledge of cybersecurity and control frameworks (ISO27001, NIST, CobIT)

- Effective communication skills, including the ability to build relationships with technical and non-technical individuals

- Be able to identify, analyze, and address problems in order to resolve issues in ways that minimize negative impact and risk to the company

- Experience evaluating security controls, conducting risks assessments, and providing guidance to platform architects/developers

- Demonstrated experience in delivering comprehensive solutions to complex security issues on a global scale

- Confidence in leading diverse matrix teams independently, making decisions daily as it relates to the successful delivery of the program

- Ability and insight to know when critical decisions must be raised to senior level and/or business unit management quickly to ensure that the program remains on track

- Department of Energy’s regulation 10 CFR 810 is required

Desired

- Industry Cybersecurity certifications (e.g. CISSP, CEH, etc.…)

- Masters in Information Security, Computer Science, Business, Engineering, or related fields

- Experience in Electric or Gas Utility or Power Generation industry, and/or experience in manufacturing

- Broad knowledge of IT and related control environments

Some positions at PSEG require access to information covered by the Department of Energy’s regulation 10 CFR 810 (Part 810). If applicable, the successful applicant must prove they are: (1) a citizen or national of the USA; OR (2) a lawful permanent resident of the United States (Non-Conditional Permanent I-551 / Green Card / Permanent Resident Card holder); OR (3) a citizen, national, or permanent resident of a “Generally Authorized” destination on the attached list not also a citizen, national, permanent resident of any country not listed; OR (4) a “Protected Individual” under the Immigration and Naturalization Act (8 U.S.C 1324b(a)(3)).

As an employee of PSEG, you should be aware that during storm restoration efforts, you may be required to perform functions outside of your routine duties and on a schedule that may be different from normal operations.

For all roles, PSEG’s drug and alcohol testing program includes pre-employment testing, testing for cause, and post-incident/accident testing.

Employees who are hired or transfer into a federally regulated role (including positions covered by USDOT, PHMSA, or NRC regulations) are subject to random drug and alcohol testing, inclusive of marijuana. Although numerous states throughout the country have legalized marijuana/cannabis products recreationally and medically, the use of these products are prohibited for employees in federally regulated roles. Please note that the use of CBD products may result in a positive drug test for THC/Marijuana and such use is not a legitimate medical explanation for a positive result.

If you are a current PSEG Long Island (PSEGLI) employee and offered an opportunity with PSEG or any of its subsidiaries other than PSEGLI, you will be treated as a new hire. Please note that as a new hire to PSEG, your benefits will change and generally will be consistent with other similarly situated PSEG new hires. Similarly, for PSEG employees who accept job opportunities with PSEGLI, your benefits will change and generally be consistent with other similarly situated new hires of PSEGLI.

PSEG is an equal opportunity employer, dedicated to a policy of non-discrimination in employment, including the hiring process, based on any legally protected characteristic. Legally protected characteristics include race, color, religion, national origin, sex, age, marital status, sexual orientation, disability or veteran status or any other characteristic protected by federal, state, or local law in locations where PSEG employs individuals.

PSEG is committed to providing reasonable accommodations to individuals with disabilities. If you have a disability and need assistance applying for a position, please call 973-430-3845 or email accommodations@pseg.com.

If you need to request a reasonable accommodation to perform the essential functions of the job, email accommodations@pseg.com. Any information provided regarding a disability will be kept strictly confidential and will not be shared with anyone involved in making a hiring decision.

ADDITIONAL EEO INFORMATION (Click link below)

Know your Rights: Workplace Discrimination is Illegal