(IT PSP) Cyber Security Controls Assessor III

Work Mode: Remote
Location: Oakland, CA
Duration: 4-6 Months

Responsibilities:

• Conduct cybersecurity control assessments for enterprise IT, cloud, and OT/industrial control system environments.
• Evaluate security controls against industry standards and regulatory requirements, including NIST Cybersecurity Framework (CSF), NIST 800-53, NERC CIP, CIS Controls, and company security policies.
• Identify security risks, control deficiencies, and compliance gaps, and recommend corrective actions.
• Prepare assessment reports detailing findings, risk ratings, remediation recommendations, and overall control effectiveness.
• Partner with cybersecurity, engineering, IT, OT, compliance, and business stakeholders to ensure risks are identified and appropriately managed.
• Validate implementation and effectiveness of security controls for new projects, system upgrades, and technology deployments.
• Support internal audits, regulatory reviews, and compliance initiatives related to critical infrastructure protection.
• Track remediation activities and validate closure of cybersecurity findings.
• Assist in maintaining assessment methodologies, standards, and procedures to support the company's cybersecurity program.
• Mentor junior assessors and contribute to continuous improvement initiatives within the Cybersecurity Risk & Compliance team.

Requirements:

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Engineering, Information Technology, or related field; or equivalent experience.
• Minimum 5 years of experience in cybersecurity, risk management, compliance, audit, or security controls assessment.
• Experience performing security assessments and evaluating cybersecurity controls.
• Knowledge of cybersecurity frameworks such as NIST CSF, NIST 800-53, CIS Controls, and risk management methodologies.
• Experience with regulatory compliance programs and audit support.
• Strong analytical, communication, and technical documentation skills.
• Ability to communicate security risks and recommendations to technical and non-technical stakeholders.

Preferred Skills:

• Experience within electric utilities, critical infrastructure, energy, or other regulated industries.
• Knowledge of NERC CIP standards and compliance requirements.
• Experience assessing Operational Technology (OT), SCADA, Industrial Control Systems (ICS), or energy management systems.
• Familiarity with cloud security environments, including Azure and AWS.
• Experience with governance, risk, and compliance (GRC) platforms.
• Professional certifications such as CISSP, CISA, CRISC, GICSP, Security+, or equivalent.