The Cybersecurity Specialist supports Versant Power’s cybersecurity posture and NERC compliance requirements by helping develop, implement, and maintain policies, systems, training support, evidence collection, and program documentation aligned to NERC standards.
Location and Work Model
Bangor, ME (onsite)
The position is primarily stationary, with some walking, standing, and driving required. Irregular hours may be required.
Compensation and Employment Status
Salary: USD 59,120 - 117,240 per year
Position status: Exempt, non-bargaining unit, full-time
Role Overview
Under the general direction of the Manager, NERC Compliance, the Cybersecurity Specialist provides support to the organization’s cybersecurity and compliance needs in accordance with the North American Energy Reliability Corporation (NERC) standards.
Key Responsibilities
- Serve as a subject matter expert on NERC Critical Infrastructure Protection (CIP) standards, with emphasis on CIP-005 Electronic Security Perimeter, CIP-007 System Security Management, CIP-012 Communications Between Control Centers, and CIP-015 Internal Network Security Monitoring.
- Collaborate with Corporate Cyber Security, Operational Technology (OT), and Information Technology (IT) teams to vet the development, implementation, and monitoring of cyber security systems protecting the Bulk Electric System (BES).
- Support the Cyber Security team in developing cyber security policies and procedures with a focus on NERC compliance.
- Evaluate technical evidence, including sources and collection procedures, to support the NERC compliance program.
- Ensure disaster recovery plans for NERC CIP assets are developed and tested.
- Assess project plans for technical components impacting CIP assets and/or labor performed within CIP areas.
- Analyze network diagrams, port configurations, and service maps to identify risk and support compliance needs.
- Work collaboratively with various NERC subject matter experts to develop procedures and processes aligned to NERC standards related to cyber security.
- Assist in development of a cyber security awareness program.
- Provide support for internal and external audits as they arise.
- Participate in regulatory compliance planning sessions, tabletop exercises, and audit preparation meetings.
- Perform other related duties as assigned, including designated duties associated with Storm Restoration.
Minimum Qualifications
- Education: Associate degree in information technology or electrical engineering (or educational equivalents).
- Experience: Three or more years of experience in information technology, cyber security, corporate compliance, operational technology, or another technical position within an electric utility.
- Tier requirements: Meet all criteria listed for Tier I.
- Certifications: Certification in related subject matters such as CompTIA Security+, CompTIA Network+, Cisco Certified Network Associate, CISSP, CISM, or ITIL preferred, or ability to acquire certification within six months of hire or promotion.
- Networking/SCADA knowledge: Understanding of computer networking technologies or Supervisory Control and Data Acquisition (SCADA) systems.
- Network management: Experience with network management and advanced network technologies required.
- Standards knowledge: Demonstrated knowledge of industry standards and frameworks, including NERC CIP, ISO/IEC 27001, NIST, or SOC 2 type 2.
- Project experience: Project management or project technical lead experience required.
- Communication and collaboration: Ability to communicate professionally and effectively with staff, vendors, law enforcement, emergency services, and the general public; willingness to collaborate and provide leadership as needed.
- Documentation: Strong attention to detail with thorough inspection practices and comprehensive documentation.
Additional Tier Requirement
- Meet all criteria listed for Tier I and II, including five years or more of experience in relevant roles within an electric utility and certification in related subject matter required.
Relevant Technologies
- CompTIA Security+
- CompTIA Network+
- Cisco Certified Network Associate
- CISSP
- CISM
- ITIL
- ISO/IEC 27001
- NIST
- SOC 2 type 2
- NERC CIP
- Supervisory Control and Data Acquisition systems (SCADA)
