Technology Engineer - Principal – ITS (SFPUC) - 1044 – (167654)

San Francisco Public Utilities Commission; San Francisco (CA); Híbrido; USD 171.000 - 215.000; Jornada completa

Descripción de la vacante

San Francisco Public Utilities Commission (SFPUC) seeks a Cybersecurity Compliance Manager to lead governance, risk, and compliance efforts under the CISO. You will coordinate across Water, Wastewater and Power enterprises to ensure regulatory adherence and robust security posture.

The role requires strategic thinking, strong partnerships, and delivering audit-ready compliance with city-wide standards. Hybrid work is supported with four in-office days per week and one remote day.

Formación

• Associate degree in computer science, computer engineering, information systems, or closely related field (or 60+ credits with relevant field).
• Five years of experience analyzing, installing, configuring, enhancing, or maintaining system components.
• One year of experience may substitute for the degree; completion of 1010 Information Systems Trainee Program may substitute.

Responsabilidades

• Oversee SFPUC cybersecurity policies, standards and guidelines.
• Coordinate with COIT, DT, OCA and Mayor's directives.
• Manage IT and OT cybersecurity compliance within the Enterprise Utilities.
• Track and report compliance with internal and city-wide policies.
• Coordinate formal cybersecurity audits with City Services Auditor and remediation activities.
• Prepare compliance reports and metrics for leadership.

Conocimientos

Cybersecurity governance

Regulatory compliance

Risk assessment

Stakeholder collaboration

Educación

Associate degree in Computer Science / Information Systems / Computer Engineering

Herramientas

CEH

ITIL

MCP/MCSE

CCNA/CCNP

CISM

PMP

COBIT

NIST RMF

NIST CSF 2.0

Descripción del empleo

About

• Application Opening: 11/9/2026
• Application Filing Deadline: 11/13/2026
• Annual Salary: $171,158 to $215,306
• Recruitment ID: 167654 (RTF0167358)

APPOINTMENT TYPE

Temporary/Permanent Exempt: This position is excluded by the Charter from the competitive Civil Service examination process and shall serve at the discretion of the Appointing Officer.

• The duration of the appointment shall not exceed 36 months.

WHO ARE WE?

San Francisco Public Utilities Commission (SFPUC)

Headquartered in San Francisco, we have 2,300 employees operating across eight counties serving more than 2.7 million customers in the San Francisco Bay Area – 24 hours per day, 365 days per year.

Our Mission: To provide our customers with high quality, efficient, and reliable water, power, and wastewater services in a manner that values environmental and community interests and sustains the resources entrusted to our care.

Our Vision: We are an innovative utility leader, recognized for excellent results in service, safety, stewardship, and inclusiveness.

We are an award-winning and industry-leading utilities organization committed to our customers, community interests, and the environment. To learn more about our organization, please visit our website at https://www.sfpuc.org/ .

We are proud of our infrastructure and programs, but most importantly, we value our highly qualified and dedicated workforce which ensures that this vision becomes a reality.

To learn more about working at the SFPUC, visit our career site at https://www.sfpuc.org/about-us/careers-sfpuc

Role Description

Project name: Cybersecurity Compliance Program Implementation

San Francisco Public Utilities Commission (SFPUC) is seeking an experienced, strategic, and highly skilled Technology Engineer-Principal to serve as Cybersecurity Compliance Manager. Under the general direction of the Chief Information Security Officer (CISO), this position is focused on the compliance and governance aspects of the SFPUC cybersecurity program.

The Cybersecurity Compliance Manager is responsible for leading and coordinating activities that assess, track, report on, and support the remediation of cybersecurity deficiencies across SFPUC’s technology and operational environments. This role works closely with Water, Wastewater, and Power enterprise stakeholders to ensure compliance with applicable cybersecurity regulations, legislation, directives, standards, and internal policies. The position supports the implementation and continuous improvement of cybersecurity governance, risk, and compliance (GRC) processes designed to strengthen the organization’s security posture and reduce cybersecurity risk.

As a cybersecurity leader, the Cybersecurity Compliance Manager collaborates with business and technology stakeholders across the SFPUC and the broader City and County of San Francisco cybersecurity ecosystem to promote consistent compliance practices, facilitate risk-informed decision-making, and support enterprise cybersecurity objectives. Responsibilities include coordinating compliance assessments and audits, monitoring corrective action plans, developing and maintaining cybersecurity policies and standards, tracking regulatory and legislative requirements, preparing compliance reports and metrics, and advising management on cybersecurity compliance and risk management matters.

In addition to strong cybersecurity expertise, this position requires sound business acumen, strategic thinking, and the ability to build effective partnerships across diverse operational and technical organizations. The Cybersecurity Compliance Manager serves as a trusted advisor to leadership and stakeholders, helping align cybersecurity compliance activities with organizational priorities, regulatory obligations, and the SFPUC’s mission of delivering essential public services securely and reliably.

This is a hybrid position that currently requires four days per week in the office and allows one remote workday per week.

Essential Functions

• Manage the SFPUC cybersecurity Policies, Standards and Guidelines to ensure the SFPUC cybersecurity expectations are effectively communicated.
• Ensure alignment with the COIT (Committee on Information Technology), the City’s Office of Cybersecurity (DT), Office of Contract Administration (OCA) and our Mayor’s Executive Directives.
• Manage the SFPUC cybersecurity compliance program for Information Technology and Operational Technology within our Enterprise Utilities.
• Track and report cybersecurity compliance to SFPUC internal policies & standards, including citywide policies and standards published by COIT, OCA and the citywide City’s Office of Cybersecurity.
• Ensure regulatory and privacy compliance requirements are met.
• Facilitate the coordinate formal cybersecurity audit activities with City Services Auditor (independent auditor). Track and report on remediation activities.
• Track and Coordinate Annual Reporting Activities, as required.
• Manage compliance associated with Emerging Technologies like AI or drones.
• Manage compliance with Emerging Regulations requiring changes like the migration to .gov and Accessibility.
• Manage compliance with SFPUC IT Policies, Standards and Guidelines to ensure the SFPUC IT expectations are effectively communicated.
• Manage compliance of Video Surveillance retention.
• Manage compliance of Records Management and Data Retention.
• Track emerging Cybersecurity legislation that may impact the SFPUC through the rule making process with the help and support of the SFPCU legislative team.
• The 1044 Technology Engineer - Principal will perform other related duties as assigned.

How to qualify

An associate degree in computer science, computer engineering, information systems, or a closely related field from an accredited college or university OR its equivalent in terms of total course credits/units [i.e., at least sixty (60) semester or ninety (90) quarter credits/units with a minimum of twenty (20) semester or thirty (30) quarter credits/units in one of the fields above or a closely-related field].

Experience

Five (5) years of experience analyzing, installing, configuring, enhancing, and/or maintaining the components of a system or platform.

Substitution

One year of additional experience as described above may be substituted for the required degree.

Completion of the 1010 Information Systems Trainee Program may be substituted for the required degree.

Applicants must meet the minimum qualification requirement by the final filing date unless otherwise noted.

Desirable Qualifications

• Utility industry experience
• Demonstrated experience with National Institute of Standards and Technology (NIST) SP800-53, NIST CSF 2.0, NIST SP 800-82, NIST SP 800-53, NIST RMF, NIST AI RMF, IEC/ISO 62443 IS0 27001/27002, ISO 3000, Americas Drinking Water Act (AWIA)
• Certified Ethical Hacker (CEH)
• Information Technology Infrastructure Library (ITIL)
• Microsoft Certified Professional/Security Engineer (MCP, MCSE)
• Cisco Certified Network Associate/Professional (CCNA, CCNP)
• Certified Information Security Manager (CISM)
• Project Management Professional (PMP)
• Understanding of application, database, network and systems security
• Understanding of general computing controls (GCCs)
• Ability to identify complex control gaps.
• Understanding of generally applicable and accepted auditing standards and framework (e.g. COBIT) and best practices for IT services management (e.g., ITIL), regulatory standards and requirements (e.g. Sarbanes Oxley Act, NERC/CIP,)

What else should I know?

Applicants may be required to submit verification of qualifying education and experience at any point during the recruitment and selection process. If education verification is required, information on how to verify education requirements, including verifying foreign education credits or degree equivalency, can be found at https://sfdhr.org/how-verify-education-requirements

Note: Falsifying one’s education, training, or work experience or attempted deception on the application may result in disqualification for this and future job opportunities with the City and County of San Francisco.

All work experience, education, training and other information substantiating how you meet the minimum qualifications must be included on your application by the filing deadline. Information submitted after the filing deadline will not be considered in determining whether you meet the minimum qualifications.

Resumes will not be accepted in lieu of a completed City and County of San Francisco application.

Applications completed improperly may be cause for ineligibility, disqualification or may lead to lower scores.

Additional Information Regarding Employment with the City and County of San Francisco

• Information About the Hiring Process
• Conviction History
• Employee Benefits Overview
• Equal Employment Opportunity
• Disaster Service Worker
• ADA Accommodation
• Veterans Preference
• Right to Work
• Copies of Application Documents
• Diversity Statement

The City and County of San Francisco encourages women, minorities and persons with disabilities to apply. Applicants will be considered regardless of their sex, race, age, religion, color, national origin, ancestry, physical disability, mental disability, medical condition (associated with cancer, a history of cancer, or genetic characteristics), HIV/AIDS status, genetic information, marital status, sexual orientation, gender, gender identity, gender expression, military and veteran status, or other protected category under the law.