Director, NERC CIP Compliance

Welcome to the intersection of energy and home services. At NRG, we're all about propelling the next generation of leaders forward. We are driven by our passion to create a smarter, cleaner and more connected future. We deliver innovative solutions that make our customers' lives easier-helping them power, protect, and intelligently manage their homes and businesses. To do this, we need creative and talented people to join our company.

We offer a dynamic work environment and a unified and inclusive culture. NRG fosters a strong sense of belonging that leads to better collaboration and business performance. Our company programs are designed to help employees develop the skills they need for success now and in the future. In everything we do, we aim to champion our employees and bring value to our customers, investors and society.

More information is available at www.nrg.com. Connect with NRG on Facebook, Instagram, LinkedIn and X.

Job Summary:

This position is part of the Regulatory Compliance team within the NRG Legal Department. NERC CIP Regulatory Compliance executes on the implementation of a framework to ensure OT security practices remain observant of all compliance directives, specifically the NERC Critical Infrastructure Protection (CIP) Standards. This role owns program governance and oversight, standards interpretation, internal control development and testing, evidence collection and verification, and corrective action implementation and tracking. This position serves as the primary Subject Matter Expert for all applicable NERC CIP requirements and ensures adoption of emergent and ever-changing cyber security regulations while working to continually strengthen NRG's audit-ready regulatory compliance posture.

Responsibilities:

The successful candidate will:

• Provide oversight for all aspects of the NERC CIP program and maintain a strong compliance posture by ensuring that all periodic requirements, reviews, testing, and evidence collection activities are completed timely and in a manner that ensures a constant state of audit readiness.
• Act as the primary Regulatory Compliance liaison with auditors, regulators, and all company stakeholders for NERC CIP matters.
• Interpret NERC CIP and other applicable cyber security standards and evaluate the business implications of existing, new, and revised NERC, Regional, Federal (CISA, TSA, etc.) standards; coordinate reviews of new/revised standards with internal stakeholders and formulate collective feedback to be provided to appropriate regulatory bodies.
• Manage the NERC standards development process and act as the company's primary voting/balloting representative for all matters CIP.
• Serve as the primary point of contact for all NERC CIP-related compliance matters and act as a trusted advisor across Plant Management, Plant NERC Compliance, IT, Engineering, Commercial Operations, Enterprise Security, and OT Security to ensure strict compliance with NERC CIP standards.
• Monitor and assist in the development of internal controls necessary to maintain adherence to NERC CIP requirements, internal policies, and other applicable cyber security standards. Assess compliance evidence gathered by technical subject matter experts to determine applicability and completeness and demonstrate compliance to NERC and Regional Regulatory bodies.
• Identify and investigate potential anomalies and/or non-compliances and escalate, as necessary; perform root cause analyses and develop corrective actions to mitigate the potential reoccurrence of near-misses and/or non-compliances. Prepare and submit self-reports as necessary.
• Partner closely with OT Security, Plant Operations, Commercial Operations, and Enterprise Security in the development of any policies, procedures, plans, or work instructions necessary to support NERC, Regional, and Federal (CISA, TSA, etc.) standards.
• Develop and maintain metrics and reporting mechanisms that provide leadership with clear visibility into the status of the NERC CIP program, including compliance statuses, trends, risks, and any remediation efforts.
• Prepare, draft, and coordinate all materials responsive to self-certifications, spot checks, audits (internal and external), Inherent Risk Assessments, Entity Risk Profile Questionnaires, and other Requests for Information. Create and maintain defensible, repeatable processes necessary to achieve a high standard of both compliance and audit-readiness for the company.
• Conduct periodic CIP compliance assessments of NRG's program and accompanying internal documentation, identify and communicate any potential deficiencies, areas for continuous improvement, and/or other findings.
• Complete compliance reviews (including zero-day compliance evaluations), evidence gathering, and holistic gap analyses pertaining to any asset acquisitions, divestitures or new asset CIP impact categorizations.
• Perform other duties as assigned by Sr. Director, Regulatory Compliance - Head of NERC Compliance.

Qualifications:

• Bachelor's degree in computer science, cyber security, business administration, or related field. Experience may be considered in lieu of college degree requirement.
• At least 8-10 years of direct work experience in regulatory compliance, audit, or cyber security within the electric utility or IPP sector.
• Proven experience implementing, managing, and/or maintaining a CIP program for an integrated utility or IPP.
• Demonstrated comprehension of the NERC CIP standards; experience writing audit-ready policies and procedures for a NERC CIP program; experience with the NERC CIP audit process, including drafting RSAWs, preparing evidentiary documentation, and presenting to regulators.
• Ability to translate regulatory requirements and technical controls into easily understood concepts and effectively communicate such concepts across stakeholders at all levels.
• Assertive, results-driven leader with a strong attention to detail that takes ownership of a program, requires minimal oversight, and is adept at problem solving.
• Analytical self-starter that exercises sound business judgment and excels in a fast-paced, high pressure, multi-task environment.
• Experience interfacing directly with and presenting to external regulators (NERC, ReliabilityFirst, TexasRE, SERC, etc.).
• Experience with NERC-specific tools, such as Align, SEL, SBS, etc.; experience with compliance management software/GRC tools, such as Sigmaflow or RSA Archer.
• Professional certification such as CISA, CISM, CISSP, or CRISC (preferred).
• Understanding of one or more of the following cyber security frameworks: NIST CSF, ISO 27001, NIST 800-53, COBIT, HITRUST.
• Familiarity with networking, change management, anti-malware, configuration baselines, patching or other OT security practices.
• Knowledge of firewalls, switches, routers, IPS/IDS, Windows, Unix/Linux operating systems.
• Strong organizational and project management skills.
• Strong interpersonal skills, including the ability to facilitate, coordinate and lead work teams.
• Proficiency in Microsoft Office Suite software (Word, PowerPoint, Excel).

Working conditions

• Travel 30% of the time within the U.S.
• Overtime as required

NRG Energy is committed to a drug and alcohol-free workplace. To the extent permitted by law and any applicable collective bargaining agreement, employees are subject to periodic random drug testing, and post-accident and reasonable suspicion drug and alcohol testing. EOE AA M/F/Protected Veteran Status/Disability. Level, Title and/or Salary may be adjusted based on the applicant's experience or skills.

EEO is the Law Poster (The poster can be found at http://www.eeoc.gov/employers/upload/poster_screen_reader_optimized.pdf)

Official description on file with Talent.

We support the use of AI tools to help you prepare for your interview (e.g., practicing responses, researching the role, or refining your resume). However, during interviews and assessments, we expect responses to reflect your own thinking, experience, and communication. Use of AI to generate or read answers in real time, complete assessments, or misrepresent your qualifications is not permitted and may impact your candidacy.