sjobs.brassring.com Open in urlscan Pro
66.77.22.60  Public Scan

Form analysis
1 forms found in the DOM

POST ../../../tgwebhost/SMSiteLoginAccount.aspx?SID=^kXZ_slp_rhc_X64OCU0Cq4ZjVXglgNQiviYFQSXG5boBjvwP4wL3n73zS3tGbUsH6mIIQ9Id

<form id="frmSMSiteLoginAccount" aria-label="Social media login authorization inputs." method="post" novalidate="" style="visibility:hidden" aria-hidden="true"
  action="../../../tgwebhost/SMSiteLoginAccount.aspx?SID=^kXZ_slp_rhc_X64OCU0Cq4ZjVXglgNQiviYFQSXG5boBjvwP4wL3n73zS3tGbUsH6mIIQ9Id" class="ng-pristine ng-valid">
  <input id="hSMSId" type="hidden" name="SMSiteId" autocomplete="off">
  <input id="hBruid" type="hidden" name="Bruid" autocomplete="off">
  <input id="hSMProfileId" type="hidden" name="SMProfileId" autocomplete="off">
  <input id="hEmail" type="hidden" name="Email" autocomplete="off">
  <input id="hSMLoginResult" type="hidden" name="Result" autocomplete="off">
  <input id="hLid" type="hidden" name="Lid" autocomplete="off">
  <input id="PPSID" type="hidden" name="PPSID" value="" autocomplete="off">
  <input id="hEncryptedData" type="hidden" name="encryptedData" value="" autocomplete="off">
  <input id="calledFrom" type="hidden" name="calledFrom" value="responsive" autocomplete="off">
  <input id="hSMLocaleId" type="hidden" name="hSMLocaleId" autocomplete="off">
  <input id="hSMJobId" type="hidden" name="hSMJobId" autocomplete="off">
  <input id="hSMTQId" type="hidden" name="hSMTQId" autocomplete="off">
  <input id="RedirectToAfterSMLogin" type="hidden" name="RedirectToAfterSMLogin" autocomplete="off">
  <input id="hSMNoback" type="hidden" name="hSMNoback" autocomplete="off">
  <input id="hdRft" name="hdRft" type="hidden" value="^KToplylAOAZwMsrLw0jJS7ut2pUA8AIUH60qzs/k6Of4sos+02Bekwv3q2sBzmSgnWCmUeptgicDzZbH6hWe5kztwNuQffQ8S37GgMkVYmg=" autocomplete="off">
  <input id="idForNewAcc" type="hidden" name="idForNewAcc" value="" autocomplete="off">
  <input id="SMLoginFlow" type="hidden" name="SMLoginFlow" value="" autocomplete="off">
  <input id="sessionid" type="hidden" name="sessionid" value="^kXZ_slp_rhc_X64OCU0Cq4ZjVXglgPElminoH0JP/JQXXOhkGTXMRLri9/NiiIYscsZ1gBnLL61l1BL65nB64advx7DbPda0pquhUNgToO7g3byDgfo=" autocomplete="off">
  <input id="policyByPassed" type="hidden" name="policyByPassed" autocomplete="off">
</form>

Text Content

Opportunity awaits...
http://sjobs.brassring.com/TGnewUI/Search/home/HomeWithPreLoad?partnerid=25810&siteid=5203&PageType=JobDetails&jobid=696030
Skip to main content

notifications and messages
Back Career Search Return to smud.org Sign In

Dark modeLight Mode


Loading


Loading
Share
Share

15-Aug-2022


MANAGER, CYBERSECURITY

Technology & Innovation

Introduction

SMUD’s Cybersecurity employees are a team of innovative professionals with a
passion for doing what SMUD does best - keeping the lights on for our community,
and we’re looking for people who want to come operate in an inclusive atmosphere
where collaboration and continuous improvement are our core to how we operate.

The Cybersecurity Manager will provide direction and oversight specifically to
SMUD’s Cybersecurity Operations department. The department's capabilities
include Security Engineering, Integrated Security Operations Center (ISOC),
Identity and Access Management, Application and Cloud Security, and Information
Asset Security. In partnership with the Manager for Governance, Risk, and
Compliance and while working closely with the Chief Information Security
Officer, the Manager of Cybersecurity Operations will strategically work to
strengthen the cybersecurity and resilience of SMUD’s information systems and
critical Infrastructure.

Purpose

The Manager, Cybersecurity oversees the enterprise cybersecurity program for
information systems and networks, including managing information security
implications within the organization, specific program, or other area of
responsibility, to include strategic, operations, personnel, infrastructure,
requirements, policy enforcement, emergency planning, security awareness, and
other resources. This position provides direct oversight for either SMUD’s
cybersecurity operations or cybersecurity governance, risk, and compliance
capabilities to ensure the confidentiality, integrity, and availability of
SMUD’s IT and OT systems, information, and network infrastructure.

Responsible for the development, implementation and management of department
goals, objectives, policies, and priorities in partnership with the department
Director; selects, trains, motivates, evaluates, and develops subordinate
personnel and ensures that department strategic objectives and priorities are
achieved and coordinated with other departments.

Position Type

Regular - Full Time

No. of Openings

1

Pay Scale Group

PAS0066F

Base Salary Annual Low

$124,482

Base Salary Annual High

$191,172

Selection Process

Initial Review, Qualifications Interview, Follow-Up Interview, Reference Check,
Background Check

Major Duties & Responsibilities



 * Supports director’s efforts to continuously improve and monitor SMUD’s
   risk-based comprehensive enterprise security program, including commensurate
   policies and procedures, to ensure that the confidentiality, integrity, and
   availability of information is owned, controlled, and properly accessed and
   processed.
 * Acquires and manages the necessary resources, including leadership support,
   financial resources, and key security personnel, to support cybersecurity
   goals and objectives and reduce overall organizational cyber risk.
 * Advises senior management (e.g., Chief Information Officer [CIO]) on cyber
   risk levels, security posture, cost/benefit analysis of information security
   programs, policies, processes, and systems.
 * Ensures that protection and detection capabilities are acquired or developed
   using security engineering approach and are consistent with
   organization-level cybersecurity architecture.
 * Ensures research, coordination, development, and communication of CIP
   policies, procedures, and standards as set forth by regulatory requirements
   from NERC, FERC, WECC, and other regulatory agencies; implements and
   maintains CIP and associated cybersecurity standards, including calendar
   driven activities for control owners; works with all CIP asset owners to
   ensure CIP compliance.
 * Ensures that security improvement actions are evaluated, validated, and
   implemented as required.
 * Establishes overall enterprise information security architecture with the
   department’s overall cybersecurity strategy.
 * Evaluates and approves development efforts to ensure that baseline security
   safeguards are appropriately installed.
 * Identifies cybersecurity program implications of new technologies or
   technology upgrades.
 * Interfaces with external organizations (e.g., government agencies like DHS
   and FBI, law enforcement, utilities) to ensure appropriate and accurate
   dissemination of incident and other computer network defense information.
 * Authority responsible for oversight and management of cybersecurity and
   privacy governance, compliance, and risk; introduces, monitors, and enforces
   policy to ensure organization-wide cybersecurity and privacy risk management
   is aligned with SMUD’s strategic goals, applicable laws, and regulations.
 * Protects company data against unauthorized disclosure, accidental or
   intentional loss of data, or unauthorized modification.
 * Manages threat or target analysis of cyber defense information and production
   of threat information within the enterprise.
 * Monitors and evaluates the effectiveness of the enterprise's cybersecurity
   safeguards to ensure that they provide the intended level of protection.
 * Prepares, distributes, and maintains plans, instructions, guidance, and
   standard operating procedures concerning the security of network system(s)
   operations.
 * Provides system-related input on cybersecurity requirements to be included in
   statements of work and other appropriate procurement documents.
 * Recommends policy and coordinates review and approval.
 * Supervises or manages protective or corrective measures when a cybersecurity
   incident or vulnerability is discovered.
 * Tracks audit findings and recommendations to ensure that appropriate
   mitigation actions are taken.
 * Evaluates the effectiveness of procurement function in addressing information
   security requirements and supply chain risks through procurement activities
   and recommends improvements.
 * Ensures that plans of actions and milestones or remediation plans are in
   place for vulnerabilities identified during risk assessments, audits,
   inspections, etc.
 * Continuously validates the organization against policies, guidelines,
   procedures, regulations, and laws to ensure compliance.

*As well as other major duties and responsibilities as outlined in the full
official description available here. 



Minimum Qualifications

Education:
Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or
related field, or equivalent experience. If no degree, 14 years of experience is
required. 

Experience: 
Ten (10) years of cybersecurity or information security experience in a
corporate or business environment, ideally in the utility industry, or
progressively responsible relevant work experience managing enterprise-wide
cybersecurity functions to include implementing technology solutions,
leading/managing oversight/operational staff, and managing various project
initiatives.

Knowledge Of:

 * Knowledge of risk management processes (e.g., methods for assessing and
   mitigating risk).
 * Knowledge of laws, regulations, policies, and ethics as they relate to
   cybersecurity and privacy.
 * Knowledge of cybersecurity and privacy principles.
 * Knowledge of cyber threats and vulnerabilities.
 * Knowledge of specific operational impacts of cybersecurity lapses.
 * Knowledge of applicable business processes and operations of customer
   organizations.
 * Knowledge of encryption algorithms.
 * Knowledge of data backup and recovery.
 * Knowledge of business continuity and disaster recovery continuity of
   operations plans.
 * Knowledge of host/network access control mechanisms (e.g., access control
   list, capabilities lists).
 * Knowledge of cybersecurity and privacy principles used to manage risks
   related to the use, processing, storage, and transmission of information or
   data.
 * Knowledge of vulnerability information dissemination sources (e.g., alerts,
   advisories, errata, and bulletins).
 * Knowledge of incident response and handling methodologies.
 * Knowledge of industry-standard and organizationally accepted analysis
   principles and methods.
 * Knowledge of intrusion detection methodologies and techniques for detecting
   host and network-based intrusions.
 * Knowledge of Risk Management Framework (RMF) requirements.
 * Knowledge of measures or indicators of system performance and availability.
 * Knowledge of current industry methods for evaluating, implementing, and
   disseminating information technology (IT) security assessment, monitoring,
   detection, and remediation tools and procedures utilizing standards-based
   concepts and capabilities.
 * Knowledge of network traffic analysis methods.
 * Knowledge of new and emerging information technology (IT) and cybersecurity
   technologies.
 * Knowledge of how traffic flows across the network (e.g., Transmission Control
   Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model
   [OSI], Information Technology Infrastructure Library, current version
   [ITIL]).
 * Knowledge of system and application security threats and vulnerabilities
   (e.g., buffer overflow, mobile code, cross-site scripting, Procedural
   Language/Structured Query Language [PL/SQL] and injections, race conditions,
   covert channel, replay, return-oriented attacks, malicious code).
 * Knowledge of resource management principles and techniques.
 * Knowledge of server administration and systems engineering theories,
   concepts, and methods.
 * Knowledge of server and client operating systems.
 * Knowledge of system software and organizational design standards, policies,
   and authorized approaches (e.g., International Organization for
   Standardization [ISO] guidelines) relating to system design.
 * Knowledge of system life cycle management principles, including software
   security and usability.
 * Knowledge of technology integration processes.
 * Knowledge of what constitutes a network attack and a network attack’s
   relationship to both threats and vulnerabilities.
 * Knowledge of information security program management and project management
   principles and techniques.
 * Knowledge of Supply Chain Risk Management Practices (NIST SP 800-161).
 * Knowledge of organization's risk tolerance and/or risk management approach.
 * Knowledge of enterprise incident response program, roles, and
   responsibilities.

*As well as other minimum qualifications as outlined in the full official
description available here.



Desirable Qualifications



 * Master’s degree in a relevant area, such as business, computer science,
   information technology, cybersecurity, or a similar relevant degree.  
 * Additional licenses or certifications: GIAC Certified Project Manager (GCPM),
   GIAC Critical Infrastructure Protection (GCIP), GIAC Information Security
   Professional (GISP), GIAC Security Essentials Certification (GSEC), GIAC
   Continuous Monitoring Certification (GMON), EC-Council Disaster Recovery
   Professional (EDRP), or EC-Council Certified Ethical Hacker (CEH).  
 * 1-3 years’ experience in a regulatory compliance (or NERC CIP specific
   experience). 
 * Project management experience.  



Licenses/Certificates

One or more of the following certifications:

 * Certified Information Systems Security Professional (CISSP)
 * Advanced Security Practitioner (CASP)
 * Certified Information Security Manager (CISM)
 * GIAC Security Leadership Certification (GSLC). 



Physical Requirements

Applicants must be able to perform the essential job functions with or without a
reasonable accommodation.

Job Code

50160085 MGR,CYBERSECURITY

Additional Posting Info for Candidate

Sacramento Municipal Utility District (SMUD) - Who We Are
As the nation's sixth-largest community-owned electric service provider, we're
proud of our reputation as one of the best places to work in Sacramento. Our
employees tell us in our engagement surveys they're "Happy, satisfied and
engaged" which helps create a workplace that best serves our customers.

Sacramento was named as the 2nd happiest place to work in America by Forbes
Magazine. Lake Tahoe, San Francisco and the world-renowned Napa Valley are
within easy driving distance of our locations.

Our Commitment to Diversity & Inclusion
SMUD respects, values and celebrates the unique attributes, characteristics and
perspectives that make each person who they are. Diversity and inclusion are
guiding principles to deliver a culture that reflects the broader values of the
community and our customers. Our Board's policy for Employee Relation sets our
commitment to developing and maintaining a high quality, inclusive workplace
that engages and inspires employees to commit to SMUD's purpose, vision and
values.

SMUD is committed to ensuring we're a workplace where diversity, equity and
inclusion (DE&I), are part of who we are and how we do things. Supporting
efforts that promote pay equality is part of that. Salary placement for the
selected candidate will be determined in alignment with the California Equal Pay
Act.

Why Sacramento, California?
The capitol of California, Sacramento is the state's sixth-largest city, and the
35th largest in the U.S. Local universities include California State University,
University of the Pacific's McGeorge School of Law, and the University of
California, Davis and several competitive community colleges. The UC Davis
Medical Center, a world-renowned research hospital, is one of more than a dozen
hospitals and shared services centers in the Sacramento region. Part of the
agriculturally-rich Central Valley, Sacramento is at the forefront of the
farm-to-fork food movement. Northern California is home to some of the country's
top technology companies, including Google and LinkedIn, and a multitude of
startups in many industries. Sacramento is home to the NBA Kings, the River Cats
(AAA baseball), the Republic FC (soccer) and the San Francisco Giants, NBA
Warriors and NFL 49er's aren't far away. Sacramento offers an affluent liberal
arts community with Broadway, Mondavi Center, Crocker Museum and summer musical
theater to name a few.

Job Expires

29-Aug-2022


MANAGER, CYBERSECURITY | SMUD CAREERS

Apply to job(s) Save Send to a friend



Affirmative Action Policy Statement
Privacy
Terms and Conditions
Careers
Infinite Talent Privacy Statement
show additional footer links
Affirmative Action Policy Statement
Privacy
Terms and Conditions

Careers
Infinite Talent Privacy Statement