• Utilize various Cyber Security tools such as Endpoint Detection and Response (EDR) and other tools to track and investigate threats within the Ontario Power Generation (OPG) information technology and systems environment in accordance with Corporate requirements and legal statutes.
• Drive remediation of vulnerabilities across OT networks by working with internal/external teams and system owners to mitigate based on a risk-based approach, that could require the business to upgrade or disable features. Provide system owners with accurate action plans and follow up on implementation.
• Work in collaboration with multiple teams across the organization to optimize procedures and processes based on events and incidents to ensure continuous improvement in improving detection and response. Keep up to date with assets, configurations, and design of the environment.
• Maintain an in depth understanding of Threat Assessments, Risk Management, and Incident Response.
• Identify and support the development of processes and procedures to improve monitoring, detection, and response to threats.
• Provide input to and maintain compliance to policies, standards, and procedures. Work with other team members to provide up to date information to stakeholders.
• Support or lead incident response lifecycle. Work with internal/external Incident Response leads, and advise on decisions during or after the incident, ensuring root cause analysis (RCA) and lessons learned are tracked.
• Conduct periodic regulatory compliance activities such as monthly patch management, quarterly access reviews, annual vulnerability assessments, and annual backup and recovery exercises to ensure the security of OPG’s Operational Technology systems and NERC CIP regulatory compliance.

QUALIFICATIONS

• 4 years of University in an appropriate field such as computer science plus 1 year of further concentrated (preferred).
• A period of over 6 years in cybersecurity or a similar field.
• Hands on experience or knowledge and understanding of NERC CIP requirements or equivalent standards would be an asset.
• Requires an advanced knowledge of computer sciences and cybersecurity, including in-depth understanding of security best practices, risks and technologies, and the solutions to address those risks.
• Requires knowledge gained through security and other training organizations, such as Information Systems Security Certification Consortium (ISC2), SysAdmin Audit Network and Security (SANS), or Information Systems Audit & Control Association (ISACA), to investigate threats to information technology systems applications, and networks, and assess, evaluate, and recommend additions, modifications or replacement.
• Requires a good knowledge of communications, both oral and written, prepare procedures and playbooks and communicate effectively with others.
• Requires experience and familiarity with various cyber security systems and tools.
• Experience managing stakeholder communications (internal & external) would be an asset.