Senior Cyber Security Officer

Winnipeg, MB

• Competitive salary and comprehensive benefits package.
• Defined-benefit pension plan for long-term financial security.
• Nine-day work cycle, typically resulting in every other Monday off to support a balanced approach to work, family life and community.

• Lead the development and implementation of the cyber security program, strategy, and roadmap for the EMS environment to ensure continued NERC CIP Compliance, alignment with enterprise cyber security goals/roadmaps, and launch our cyber security maturity to new levels:
  - Develop, implement and monitor security related metrics to track roadmap implementation status, and security health of the EMS environment.
  - Define, implement, and maintain operational security standards and procedures to support execution of the cyber security roadmap.
  - Create related reports or presentations to be delivered to management and relevant governance committees.
• Lead, recommend, plan, install, configure, monitor and upgrade appropriate security tools, controls, and countermeasures to protect systems in the EMS environment against all types of cyber security threats:
  - Maintain and improve the malicious software prevention program.
  - Develop, monitor and facilitate the security risk management program.
  - Track and conduct assessments on newly released vulnerabilities and security patches.
  - Develop and implement mitigation plans for identified vulnerabilities.
• Lead and assist with cyber security audits of systems, applications and networks, and coordinate third-party audits including external assessments, internal and NERC CIP audits as required.
• Establish incident response and communication plans:
  - Coordinate and align with Cyber Security Operations Centre enterprise cyber security incident response and communication plans.
  - Create specalized centralized OT plans which provide clear and concise direction to other staff responding to or assisting in the incident response.
  - Develop communication strategies and guidelines to best enable enterprise wide coordination on centralized OT aspects of a response, adherence to NERC CIP and CIS incident response requirements, and appropriate communication to impacted departments and standard owners.
  - Develop training, presentations, and exercises for these plans as required.
• This position leads CCTS Cyber Security program involvement and implementation of multiple security programs (ICS CSRM, NERC CIP, Technology Security), provides assistance and consultation on several others, and is a recognized leader within System Operations and Manitoba Hydro. 
• Providing guidance and consulting assistance to all Manitoba Hydro System Operation Division staff and management on overall Cyber Security risk, Cyber Security controls, governance, and best practices is also part of this position.
• Regularly communicate best practices and guidance to improve the over-all cyber security posture and culture of Systems Operations division by presenting Cyber Security best practices that considers the unique differences and struggles OT networks and operators have when improving Cyber Security.
• Lead the proactive security monitoring and reporting program using tools such as the SIEM system including leading the centralized OT threat intellegance program. Evaluate incoming threat intelligence for applicability and severity and determine appropriate counter-measures and mitigations necessary. Provide information to system SMEs and briefings to management as required based on severity and likelihood of a threat. 
• Responsible for network intrusion detection and prevention policy, procedures, and systems. 
• Respond to and ensure root causes for suspected security breaches and failures are identified and fully addressed. 
• Lead, plan, coordinate, and conduct cyber security incident response exercises and assessments.
• Develop cyber security playbooks. Lead implementation of SOAR (Security Orchestration Automation and Response).
• Provide round-the-clock support, as required, on an emergency basis to lead the response to a cyber security event.
• Receive and analyze security alerts from various sources.
• Apply DevSecOps principles wherever possible in the implementation, testing, and maintenance of supported infrastructure. 
• Keep current on all cyber security related issues:
  - Identify and establish contacts with industry peers and information sources to keep abreast of emerging and relevant cyber security issues and risks.
  - Conduct cyber security research.
  - Represent MH as an OT cyber security expert on internal & external cyber security committees.
• This position will be responsible for mentoring junior staff and their understanding and development in the cyber security and centralized OT areas. 
• Provide 24-hour support (standby) to the System Control Centre as part of the EMS Infrastructure and Applications on call rotation.

• A four year degree in Computer Science or Computer Engineering from a university of recognized standing plus a minimum of six years of directly related experience in the field of information/computer technology and cyber security.
  OR
• A two year diploma in Computer Programming Technology from an institute of recognized standing plus a minimum of eight years directly related experience in the field of information/computer technology and cyber security.
  OR
• An equivalent combination of education and experience may be considered.
• Global Information Assurance or ICS2 Certification(s) would be considered an asset.
• Demonstrated initiative and ability to plan, organize, schedule and complete a high volume of work within strict timelines.
• Demonstrated ability to establish and maintain successful working relationships with external and internal contacts in multiple departments and positions. 
• Demonstrated ability to communicate effectively, both orally and in writing.
• Demonstrated advanced level knowledge of IT and OT systems and networks.
• Expert level knowledge of NERC CIP Standards, Programs and Procedures.
• Subject matter expert in cyber seucirty policies, practices, controls, and tools. 
• Expert level knowledge and experience with Intrusion Detection Systems and Endpoint Detection & Response systems.
• Expert with Security Information and Event Management (SIEM) systems, Security Orchestration & Automated Response (SOAR) platforms and threat intelligence platforms. 
• Demonstrated commitment to continuous learning and keeping pace with changing technology and related best practices. 
• Demonstrated forward thinking and ability to identify and implement continuous improvement.
• Demonstrated knowledge of Lean and DevOps / DevSecOps.
• Obtain and maintain a current Personnel Risk Assessment and a "Clear" security rating in accordance with Manitoba Hydro policy P513.
• Completed Critical Infrastructure Protection (CIP) Training prior to transfer and renewed annually.
• Completed Standards of Conduct training within two weeks of start date and renewed annually. 
• Reside within the headquarters zone. 
• Possess a valid Province of Manitoba Driver's Licence with appropriate classification.
• Be available after hours to lead response to critical and urgent issues as needed. Occasional travel to field or office work sites outside the headquarters zone will be required.