Coordinator-Compliance NERC/CIP & GAD

Responsibilities: Essential duties and responsibilitiesDesign, Construction & Commissioning PhaseIntegrate NERC CIP requirements into plant design, network architecture, and control system configurations. Lead BES Cyber System identification, impact rating strategy, and boundary definition prior to commissioning. Review EPC, OEM, and integrator designs for CIP compliance, including ESP/PSP architecture. Oversee CIP‑013 supply chain risk management, including vendor cybersecurity controls and contract requirements. Support FAT/SAT activities to validate CIP controls before system acceptance. Establish initial compliance evidence, baselines, diagrams, access lists, and recovery plans. NERC Compliance Program ManagementServe as the site subject‑matter expert (SME) for applicable NERC Reliability Standards (CIP and O&P). Maintain and execute the site’s NERC Compliance Implementation Plan, including policy/procedure governance and evidence lifecycle management. Monitor regulatory updates (NERC/FERC/RRO) and implement changes, interpretations, and new standards within required timelines. Own BCS identification, impact rating, asset inventory, and boundary documentation; coordinate updates with Engineering and OT. Develop, maintain, and submit Reliability Standard Audit Worksheets (RSAWs), self‑certifications, and periodic data submittals. CIP Cyber & Physical Security OversightManage compliance for CIP‑002 through CIP‑014 as applicable, with emphasis on CIP‑002 (BCS), CIP‑003 (security management controls), CIP‑004 (training & access), CIP‑005 (ESP), CIP‑006 (PSP), CIP‑007 (system security & patching), CIP‑008 (incident reporting), CIP‑009 (recovery), CIP‑010 (configuration change & vulnerability assessments), CIP‑011 (information protection), and CIP‑013 (supply chain risk). Oversee Electronic Security Perimeter (ESP) and Physical Security Perimeter (PSP) controls including access authorization, revocation, logging/monitoring, and periodic reviews. Coordinate CIP‑compliant account management, MFA where applicable, jump host usage, firewall rules, and remote access controls for Emerson Ovation DCS and supporting BCS. Coordinate with IT/OT on patch management (CIP‑007), baseline & change management (CIP‑010), vulnerability assessments, backups & recovery (CIP‑009), and log retention. Ensure secure handling and disposal of BES Cyber System Information (BCSI) per CIP‑011 and manage vendor/supply chain controls per CIP‑013. Documentation, Evidence & Audit ReadinessDevelop and maintain complete, accurate, and verifiable compliance documentation, procedures, and records. Lead internal readiness reviews and coordinate external audits/spot checks; manage mitigation plans and corrective actions. Maintain evidence repositories (e.g., RSAWs, logs, access reviews, change records) with version control and retention compliance. Prepare responses to data requests; ensure traceability between standards, procedures, and evidence artifacts. Training & Compliance CultureAdminister and track NERC/CIP training and access authorizations for employees and contractors (CIP‑004). Deliver site briefings, tabletop exercises, and awareness campaigns on CIP responsibilities and cyber hygiene. Promote a proactive, audit‑ready culture across Operations, Maintenance, Engineering, and Corporate functions. Operational & Technical SupportEvaluate plant modifications (network/DCS/BCS/access systems) for NERC/CIP impacts and ensure compliant implementation. Support incident response and reporting (CIP‑008) and root cause analysis; coordinate lessons learned and mitigations. Partner with Maintenance on Maximo CMMS work processes to embed compliance controls into work planning, access, and change activities. Coordinate with corporate cybersecurity, IT, and engineering for risk assessments, penetration tests (if applicable), and remediation tracking. Generating Availability Data System (GADS) ReportingManage all GADs data collection, validation, and submittals in accordance with NERC/IEEE requirements. Ensure accuracy of event, performance, and outage data for GT and CCGT units. Coordinate with Operations, Maintenance, and Engineering to verify reliability event classifications. Maintain documentation, evidence, and audit readiness for GADs reporting. Tools & SystemsDistributed Control System (DCS): Emerson Ovation (operations, configuration management, backups, and security hardening). Enterprise Asset Management: Maximo CMMS (work management, change control tie‑ins, and evidence capture). Identity & Access Management: badge systems, directory services, MFA solutions, privileged access workflows. Network & Security: firewalls, switches, SIEM/logging, jump hosts, secure remote access, vulnerability scanning tools. Document & Evidence Repositories: version‑controlled storage for procedures, RSAWs, logs, and audit artifacts.

Qualifications: JOB REQUIREMENTSEducationMinimum requirementsBachelor’s degree in Engineering, Cybersecurity, Information Systems, or related field; equivalent experience considered. Experience/Specific Knowledge 5+ years of direct NERC/CIP compliance experience in power generation, utility, or similar critical infrastructure. Working knowledge of BES Cyber System classifications/impact ratings and applicable NERC CIP and O&P standards. Hands‑on familiarity with control system/OT environments (Emerson Ovation preferred) and OT network concepts. Experience with patching, configuration/change management, access controls, backup/recovery, and log retention in regulated environments. Strong technical writing, documentation, and audit‑preparation skills; ability to organize complete, accurate, and verifiable evidence. Intermediate proficiency level in MS Office applications that may include but are not limited to Outlook, Excel, Word, and PowerPoint. Certifications, Licenses & Registrations: Must possess and maintain a valid driver’s license and a driving record satisfactory to the company and its insurers (for travel). Competencies, Skills & AbilitiesRegulatory Compliance & Audit Readiness Cybersecurity & OT Risk Management Technical Writing & Documentation Control Stakeholder Communication & Training Delivery Project Management & Prioritization Analytical Thinking & Attention to Detail Cross‑Functional Collaboration (IT/OT/Operations/Maintenance) Physical DemandsSitting; standing; walking or moving throughout the facility; driving; talking; seeing (specific vision abilities required by this job include close vision, distance vision, peripheral vision, depth perception, and ability to adjust focus); hearing; feeling; bending or stooping; squatting or crouching; reaching; kneeling; pushing; pulling; lifting to 25 lbs. Must be able to sit for prolonged periods of time.