Security Program Lead

The Security Program Lead oversees key ancillary functions and supporting services that are an integral part of the larger program to secure and protect NYISO resources including security program administration, strategic planning, security budget and resource planning, security metrics and reporting, security training and awareness, security maturity assessment, and facilitation of industry partnerships. The Security Program Lead evaluates existing NYISO security measures, assesses the effectiveness of those measures, and recommends changes that will improve all aspects of NYISO security.

ESSENTIAL DUTIES and RESPONSIBILITIES 

• Administers the security strategic planning process, including development of IT and security strategy into strategic plan milestones and program plans. Facilitates meetings and discussions to create actionable department plans to accomplish the security strategy.
• Develops and leads programs to expand accountability for security across the organization, including actions that empower and support the various information technology functions. Ensures tools, training, and processes from all areas support enhanced accountability for security, and security risk is considered during project planning, design, and implementation activities. 
• Develops and leads the NYISO Security Awareness program, and champions a culture of security and compliance across the organization through effective & engaging communications, awareness campaigns, and other activities. Plans and develops high-impact communications campaigns to convey security concepts to the organization. 
• Facilitates budget and resource planning for all aspects of the security program
• Develops structured, relevant security training for all employees and contractors, and oversees training programs to ensure security competency and compliance with regulatory requirements for training.
• Leads the Enterprise Security Steering Committee to ensure alignment of the security program with key business partners, and implementation of security processes and controls in a manner that still permits the efficient conduct of business
• Develops and leads large regional security exercises for NY State electric sector members, government, and other stakeholders, and facilitates NYISO participation in GridEx, CyberStrike, and other national cyber security exercises.
• Leads the NYS Security Working Group, including development of the function, organization of quarterly meetings, governance of activities, and interaction with constituents to develop a collective approach to cybersecurity in the NYISO footprint. Organizes and facilitates relationships with selected stakeholder groups, public and private utilities, designated electricity industry organizations, State and Federal organizations and utility regulatory staff to ensure secure, reliable and resilient operation of the New York Bulk Electric System (BES).
• Develops and tracks security program metrics that measure the performance and effectiveness of security processes, controls, and technologies, and reports on performance to NYISO leadership and other stakeholders in clear, relatable business terms.
• Establishes a security maturity measurement program using industry frameworks such as NIST and ES-C2M2, and then facilitates ongoing measurement and reporting on the effectiveness of security controls, processes, and initiatives.
• Leads the organizational effort to stem risks associated with phishing, vishing, and other forms of social engineering through development of phishing simulation, awareness efforts, and other methods. Makes recommendations on initiatives to improve organizational response and susceptibility.
• Develops clear, well-written, and concise communication for NYISO employees with timely and appropriate recommendations to respond to security and compliance threats, vulnerabilities and other risks to the NYISO.
• Develops a deep understanding of NYISO energy and market management systems, and provides guidance on the effective application of security standards and guidelines to NYISO business partners, serving as their advocate to ensure the highest degree of support from Enterprise Security.
• Leads and/or participates in special projects, programs, and initiatives as directed by the Chief Information Security Officer.
• Develops professional, polished communications and messaging on security matters for NYISO executives, staff, stakeholder groups, industry councils and associations, and government partners.
• Engages with Information Technology, Product & Project Management, and other delivery teams to provide guidance on implementing security and compliance guidelines in a balanced and appropriate manner. Develops strategies to ensure the ubiquity of security and advocates on behalf of NYISO business partners.

QUALIFICATIONS 

• Bachelor's degree (BS) in Information Security, Computer Science, or Business with extensive coursework in Information Systems or related field required. MS/MBA preferred. 
• Seven years progressively more responsible experience in a combination of information security, compliance, and information technology positions, including at least three years in a role supporting executive leadership with security, information technology, and/or compliance matters is required.
• Knowledge of security concepts, standards, protocols, and technologies is required.
• CISSP, GSEC, CPP, CISM and/or CISA are a plus.

ADDITIONAL REQUIREMENTS

• Exceptional written communication and presentation skills are required
• Ability to effectively communicate security and risk-related concepts to technical and nontechnical audiences.

PHYSICAL DEMANDS

While performing the duties of this job, the employee is regularly required to talk or hear.  The employee frequently is required to stand, walk, sit and use hands to perform routine office tasks.  The employee is occasionally required to reach with hands and arms.  The employee must occasionally lift and/or move up to 15 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

WORK ENVIRONMENT

The noise level in the work environment is usually moderate.  Contact with staff and public will occur.  Travel may be required to attend and/or conduct meetings, conferences and training.­­­­­­­­­­­­ This position may require work on nights, weekends or holidays.

The NYISO takes pride in recruiting, developing and retaining highly talented individuals. In addition to competitive salaries, we offer a comprehensive benefits package and innovative reward programs.

The NYISO offers the flexibility to work both in the office and remotely, providing our employees with an enhanced work life balance. While the majority of the responsibilities of this role can be performed remotely, in most cases, employees will have periodic on-site requirements based on business needs.

All offers of employment will be made contingent upon the successful completion of a drug screening and background check.

The NYISO is an Equal Opportunity Employer and as such, does not discriminate in its hiring or employment practices.