Manager, CIP Compliance

Position Description

Under the direction of the Director of Compliance Monitoring, the Manager, CIP Compliance leads and oversees Critical Infrastructure Protection (CIP) compliance monitoring activities within NPCC's Compliance Monitoring and Enforcement Program (CMEP). The position is responsible for managing CIP compliance monitoring engagements, supervising staff, supporting risk-based compliance monitoring initiatives, and fostering effective relationships with Registered Entities and ERO Enterprise stakeholders.

The Manager assists with the development and implementation of compliance monitoring strategies and programs, oversees the performance and quality of CIP compliance monitoring activities, and ensures compliance monitoring engagements are conducted in accordance with NERC Rules of Procedure, NPCC CMEP processes, and applicable Canadian provincial agreements.

Key Responsibilities

• Ensures processes and procedures are established, maintained, and continuously improved to support CIP Compliance Audits, Self-Certifications, Spot Checks, and other compliance monitoring activities.
• Periodically reviews and updates compliance monitoring processes to incorporate changes to NERC Rules of Procedure, CMEP guidance, FERC Orders, Canadian agreements, emerging risks, and ERO Enterprise initiatives.
• Supports the implementation of risk-based compliance monitoring activities through the evaluation of entity risks, internal controls, compliance history, and other relevant risk indicators.
• Assists in the development and execution of annual compliance monitoring plans, monitoring strategies, and related program initiatives.
• Supports the Director of Compliance Monitoring in developing, maintaining, and reporting compliance monitoring documentation, records, metrics, and key performance indicators.
• Manages CIP compliance monitoring engagements across the United States and Canada in accordance with NERC Rules of Procedure, NPCC programs, and applicable provincial agreements.
• Serves as Audit Team Lead for assigned engagements, directing audit activities, coordinating resources, facilitating team discussions, reviewing work products, and ensuring the quality and consistency of engagement results.
• Assists in developing compliance monitoring scopes using risk-informed considerations, including inherent risk assessments, internal controls evaluations, compliance history, and other relevant factors.
• Reviews audit workpapers, engagement documentation, reports, and other compliance monitoring deliverables to ensure accuracy, consistency, quality, and adherence to NPCC and ERO Enterprise expectations.
• Ensures compliance monitoring activities are completed in accordance with established timelines and milestones, including notifications, evidence submissions, interviews, site visits, report development, entity comment periods, and final report issuance.
• Identifies CIP compliance trends, emerging risks, and industry developments and contributes to the creation of lessons learned, outreach materials, and analytical reports.
• Maintains a thorough understanding of NERC Rules of Procedure, Reliability Standards, standards under development, and related industry initiatives.
• Supervises, coaches, and develops CIP compliance monitoring staff through performance management, mentoring, technical guidance, and professional development opportunities.
• Monitors staff performance and supports employee growth through training, succession planning, and continuous development initiatives.
• Supports recruitment and hiring activities, including candidate sourcing, interviewing, selection, and onboarding.
• Develops and maintains effective working relationships with Registered Entities, NERC, Regional Entities, and other industry stakeholders.
• Facilitates constructive discussions with Registered Entities regarding audit scope, evidence requests, internal controls, compliance monitoring results, and opportunities for continuous improvement.
• Ensures CIP compliance monitoring staff adhere to NPCC policies and procedures, including antitrust, conflict of interest, confidentiality, and professional conduct requirements.
• Develops and delivers training, education, outreach, and communications to NPCC staff, Registered Entities, and ERO Enterprise personnel.
• Represents NPCC on ERO Enterprise committees, task forces, working groups, and special projects.
• Performs other duties and special projects as assigned.

Education Requirements

Required Education

• Bachelor’s degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or a related technical field and ten (10) or more years of relevant industry experience; or an equivalent combination of education and experience demonstrating the ability to perform the essential functions of the position.

Preferred Education

• Master's degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or a related field.

Experience Requirements

Required Experience

Minimum ten (10) years of experience in the electric utility industry or a related technical field with experience in one or more of the following areas:

• Desktop and systems design

• Experience evaluating compliance programs, internal controls, risk mitigation practices, or governance processes associated with NERC Reliability Standards.
• Ability to analyze compliance monitoring results, identify trends, and develop recommendations and reports for management and industry stakeholders.

Preferred Experience

• Experience managing compliance monitoring activities conducted under delegated regulatory authority.

• Experience working with Canadian provincial reliability agreements, Memoranda of Understanding, or cross-border regulatory frameworks.

• Experience implementing risk-based compliance monitoring programs and evaluating internal controls.

• Proficiency in the NP-View network analysis tool.

• Experience participating in ERO Enterprise working groups, committees, task forces, or industry initiatives.

• Experience developing strategic plans, departmental budgets, performance metrics, and organizational goals.

• Experience with risk-based compliance monitoring methodologies.

• Experience evaluating and testing compliance-related internal controls.

• Experience serving on ERO Enterprise task forces, working groups, standards drafting teams, or industry committees.

Preferred Certifications

• Certified Information Systems Security Professional (CISSP)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• GIAC Critical Infrastructure Protection (GCIP)
• Project Management Professional (PMP)
• Certified Internal Auditor (CIA)
• Other relevant professional certifications or licenses

Skills and Abilities

• Strong leadership, supervisory, coaching, and mentoring skills.
• Ability to lead cross-functional teams and manage complex compliance monitoring engagements.
• Ability to exercise sound professional judgment in complex or sensitive compliance matters.
• Strong analytical, problem-solving, and critical-thinking skills.
• Excellent verbal, written, and presentation skills.
• Ability to communicate technical and regulatory concepts effectively to executive, technical, and non-technical audiences.
• Excellent interpersonal, relationship-building, and conflict-resolution skills.
• Strong project management, organizational, and prioritization skills.
• Ability to manage multiple projects and competing priorities in a dynamic regulatory environment.
• Ability to effectively engage and collaborate with internal and external stakeholders.
• Ability to develop and deliver professional presentations and training programs.
• Strong attention to detail and commitment to quality.
• Strong teamwork and collaboration skills.
• Advanced proficiency with Microsoft Office applications, including Word, Excel, PowerPoint, Outlook, and Teams.
• Ability to participate in and lead virtual teams.
• Demonstrated sound judgment, professionalism, and commitment to integrity, confidentiality, and ethical conduct.

Physical Requirements

• Prolonged periods of working on a computer.
• Travel to main office and in-person meetings, as required (barring no restrictions based on travel or health advisories, or occupancy restrictions).
• Ability to work and travel within the U.S. and travel to Canada.

EEOC DISCLAIMER

NPCC is an Equal Opportunity Employer. Employment, including the decision to hire, promote, discipline or discharge, will be solely based on competence, performance, and business needs. We prohibit discrimination on the basis of the individual’s actual or perceived disability, protected veteran status, race, color, sex, age, national origin, religion, sexual orientation, gender, gender identity, gender expression, genetic information, marital status, citizenship, domestic violence victim status, or any other status protected under federal, state or local law.

Job Type: Full-time

Work Location: Remote