Cybersecurity Senior Advisor

Join Southern California Edison in a hybrid role focused on measurable security outcomes across both enterprise IT and critical OT environments. As a Cybersecurity Senior Advisor, you will lead hands-on exposure and risk assessments, validate security controls, and translate findings into risk treatment plans with clear ownership and timelines. This position also supports secure-by-default engineering practices and remediation through to closure, helping ensure strong protection of physical, financial, and cybersecurity assets, along with careful handling of private and highly sensitive information.

What you’ll do

• Lead cybersecurity project delivery by aligning the team to success criteria, surfacing delivery issues and risks, and building commitment with internal and external delivery partners.
• Design, implement, and maintain a secure security posture and baseline across on-premises and cloud IT environments using recognized security engineering practices and supporting secure build processes.
• Develop, maintain, and deliver secure system profiles and maintain an overall view of compliance across organizational components.
• Partner with IT and Quality teams to assess, remediate, and prevent information technology risks, including system auditing, vulnerability risk assessments, assured file transfers, configuration management, data integrity containments, and investigation support for security violations and incidents.
• Ensure security applications and systems integrate successfully during implementations, updates, and patching to maintain or increase detection and prevention capabilities.
• Collaborate with an external managed security solution provider and analysts to improve security solutions by analyzing security data, reviewing the threat landscape, and assessing security tickets.
• Work with the infrastructure team and security architect to analyze threats and recommend technical infrastructure and architecture changes that close gaps and reduce risk.
• Shape procedures and methods for auditing and addressing risk and non-compliance to information security standards.
• Build relationships with senior leaders and stakeholders to map business priorities to secure design solutions and effective security engagement.

Additionally, you’ll partner with infrastructure teams for threat modeling and attack-path analysis, then recommend technical changes such as segmentation, identity controls, hardening, and logging. You will also lead deep-dive assessments that validate controls, prioritize vulnerabilities, review configuration baselines, and drive risk treatment plans, including support for investigation and root-cause analysis for incidents and policy violations. You will define success metrics for complex security initiatives and coordinate technical risks and dependencies through design and rollout.

Systems, frameworks, and standards

• Maintain secure-by-default baselines for on-prem and cloud environments, including hardening standards, access controls, key and secret handling, and automated guardrails.
• Create and maintain hardened system profiles and compliance mappings, tracking posture, drift, and remediation progress across enterprise platforms.
• Establish repeatable assessment, evidence, and exception-handling methods aligned to information security standards and regulatory requirements, ensuring findings convert into actionable remediation backlogs with clear owners and timelines.

What you bring

• Ten or more years of experience in information technology, information security and/or cybersecurity.
• US Citizenship Required.

Tools and standards you may work with

• NIST CSF, NIST 800-53, ISO 27001
• CISSP, GSEC, GICSP
• NERC/CIP

Preferred qualifications

• Bachelor’s Degree in Engineering, Information Technology, Cybersecurity, Environmental or Physical Sciences, Business or related discipline.
• Familiarity with security frameworks (for example, NIST CSF / NIST 800-53, ISO 27001) and translating requirements into implementable controls and evidence.
• Hands-on assessment experience across enterprise environments (on-prem + cloud), including control validation, configuration review, penetration testing, code review, and/or vulnerability triage.
• CISSP, GSEC, GICSP, or other related security certifications.
• Strong OS and network fundamentals (Windows/Linux internals, TCP/IP, DNS, PKI/TLS) applied to troubleshooting and security analysis.
• Operational Technology exposure (industrial networks, Purdue model concepts, segmentation, asset inventory constraints) or clear willingness to learn OT.

Additional information

• Work mode: hybrid. Report to an SCE facility for a set number of days with the option to work remotely on remaining days.
• Unless otherwise noted, employees are required to work and reside in California or Washington, DC.
• Work mode may change based on business needs.
• Primary work location: Rosemead, CA or Washington, DC.
• Travel: up to 10%, including being out in the field throughout the SCE service territory.
• This is a NERC/CIP impacted position. Prior to hire, the successful candidate must pass a Personnel Risk Assessment (PRA) or Background Investigation.
• Training is required prior to gaining un-escorted access to assigned work locations.
• Relocation may apply.
• Qualified applicants with arrest or conviction records will be considered in accordance with applicable fair chance laws.