Senior NERC CIP Compliance Analyst

CAMS; New Haven (CT); On-site; USD 90,000 - 120,000; Full time

Benefits offered by this job

Medical insurance

401(k) plan

Tuition reimbursement

Job summary

CAMS is seeking a Sr. NERC CIP Compliance Specialist in New Haven, Connecticut. This role involves leadership to maintain compliance with NERC CIP standards, cybersecurity initiatives, and operational integrity in power generation environments.

The ideal candidate should have at least 7 years of relevant experience and strong skills in regulatory compliance and cybersecurity. A comprehensive benefits package is provided, including medical, dental, vision, and 401(k) plans.

Qualifications

• Minimum of 7–10 years of professional experience in regulatory compliance, power utility operations, or industrial cybersecurity.
• At least 5 years of hands-on experience implementing and managing a NERC CIP compliance program.
• Ability to pass a mandatory NERC CIP-004 Personnel Risk Assessment and background check.

Responsibilities

• Ensure continuous adherence to NERC CIP standards.
• Lead RSAW/ERT preparation and audits.
• Manage compliance deviations and conduct self-assessments.

Skills

Regulatory compliance

Cybersecurity

Power utility operations

Risk assessments

NERC CIP standards

Education

Bachelor’s degree in Engineering, Computer Science, IT, Cybersecurity

Tools

PPE

Audit tools

Job description

Job Overview

The Sr. NERC CIP Compliance Specialist provides critical on-site leadership to protect and maintain the integrity of control and business networks at Low and medium-impact generating stations. This role drives continuous compliance with NERC CIP cybersecurity standards, leads site security initiatives, and serves as the primary subject matter expert for station personnel. Operating as a key liaison, it partners with cross‑functional stakeholders to enforce a secure operational environment and ensure continuous audit readiness through rigorous evidence management.

Essential Duties and Responsibilities

• Build, optimize, and maintain on‑site processes and documentation to ensure continuous adherence to NERC CIP standards.
• Maintain accurate cyber asset inventories and manage baseline change control workflows.
• Lead RSAW/ERT preparation and submission for Regional Entity audits, spot checks, and compliance investigations.
• Maintain compliant physical and electronic security perimeters and access controls for all site assets.
• Execute daily, monthly, quarterly, and annual CIP compliance activities in accordance with program procedures.
• Serve as the primary site contact for Regional Entities and coordinate cross‑functional teams to fulfill RFIs and remediate findings.
• Deliver and support mandatory NERC CIP cybersecurity compliance training programs for site personnel.
• Direct the end‑to‑end patch management lifecycle, ensuring BES cyber assets are monitored and updated within regulatory timelines.
• Lead the annual testing, documentation, and reporting of the Cyber Security Incident Response Plan (CIP‑008) and Recovery Plans (CIP‑009).
• Orchestrate annual Critical Vulnerability Assessments (CVAs) while ensuring zero adverse impact to operational BES infrastructure.
• Oversee the identification, classification, and secure handling of Bulk Electric System (BES) Cyber System Information (BCSI) to prevent unauthorized disclosure.
• Lead supply chain risk assessments and collaborate with procurement/legal to enforce cybersecurity contract clauses.
• Conduct proactive internal compliance self‑assessments; manage the identification, self‑logging, and mitigation of compliance deviations.

Requirements

• Bachelor’s degree in Engineering, Computer Science, IT, Cybersecurity, or a related technical discipline (equivalent direct experience considered).
• Minimum of 7–10 years of professional experience in regulatory compliance, power utility operations, or industrial cybersecurity.
• At least 5 years of hands‑on experience implementing and managing a NERC CIP compliance program across Medium or High‑impact assets.
• Demonstrated success drafting RSAWs, preparing ERT responses, and managing RFIs during Regional Entity audits or spot‑checks.
• Deep operational understanding of the 35‑day patch/baseline lifecycle (CIP‑007/010), security perimeters (CIP‑005/006), and supply‑chain management (CIP‑013).
• Ability to successfully pass a mandatory NERC CIP‑004 Personnel Risk Assessment and background check.
• Ability to work full‑time on‑site at the designated facility, travel up to 25% as needed, and safely navigate physical plant environments.
• Ability to perform physical job duties, including lifting up to 25 pounds, climbing, bending, and working in industrial environments; use of PPE is required.
• Valid driver’s license with a clean driving record; comfortable operating a vehicle as part of job responsibilities.

Preferred Skills and Certifications

• Prior experience working directly within a power generation plant, transmission control center, or EMS/GMS environment.
• NERC Certified Compliance Professional (NCCP) designation.
• CISSP, CISA, or CISM certification.
• SANS GIAC certifications, specifically GCIP or GICSP.
• Established working relationships and direct audit experience with our specific Regional Entity (e.g., SERC, WECC, NPCC, RF, MRO, Texas RE).
• Commitment to cybersecurity excellence and regulatory compliance.

Benefits

CAMS offers a comprehensive benefits package for full‑time employees, including medical, dental, vision, LTD, STD, and life insurance plans. Employees may also select additional a‑la‑carte benefits, enroll in a 401(k) plan, and take advantage of flex spending accounts for medical and childcare needs. Employee referral and tuition reimbursement programs are also available.

EEO Statement

Qualified applicants must be legally authorized to work in the United States and will not require any employer‑sponsored work authorization now or in the future.

Compensation

The salary range for this position is commensurate with experience, qualifications, and location. Actual compensation will be determined based on several factors, including skills, experience, and relevant qualifications. The base salary range does not include other forms of compensation such as bonuses, benefits, or equity.