Role and Responsibilities
Extend and maintain a cyber security advisory practice providing expert strategic and technical cyber security advice to influence decision makers ensuring that compliant and effective cyber security strategy, frameworks, policies, standards and guidelines are in place.

Responsibilities

Regulatory

• Ensure GreenPoint Energy complies with the cyber security regulatory obligations including the Security of Critical Infrastructure Act (SOCI Act) and AEMO’s NEM/NER requirements and performance standards.
• Assess and maintain AESCSF Security Profile 1 (SP-1) compliance for GreenPoint Energy’s Critical Infrastructure Assets.
• Assess and ensure closure of identified gaps to AESCSF practices for GreenPoint Energy company environment.

Risk

• Assess and manage cyber security risks and maintain cyber security risk register.
• Maintain cyber domain section of GreenPoint Energy’s Critical Infrastructure Risk Management Plan (CIRMP).
• Present monthly to the Risk & Governance Committee on GreenPoint Energy’s cyber security posture (issues, incidents, exposure, weaknesses) and identify and manage resolution.

Standards

• Update GreenPoint Energy’s cyber security standards to align with AESCSF practices and ensure fit-for-purpose.
• Manage and govern deviations from cyber security standards, identifying risk and mitigating actions.

Architecture

• Provide cyber security architecture and control guidance to capital projects, the business and IT resources.
• Specify requirements in specifications for new Critical Infrastructure Asset projects (including BESS and SCADA designs).
• Develop or assess security solutions for projects in conjunction with Owner’s Engineers.

Response

• Oversee the external Security Operations Centre (SOC) provider and provide oversight of engagement with external OT/SCADA engineering services provider and report on SOC effectiveness.
• Monitor cyber threats, vulnerabilities, suspicious activities and intrusions.
• Act as lead cyber resource in incident management and response including reporting to the regulator in accordance with GreenPoint Energy’s standards, SOCI legislation and AEMO’s NEM/NER requirements.

Third-parties

• Manage and mitigate the risk of overseas O&M providers’ remote access to GreenPoint Energy’s Critical Infrastructure Assets.
• Conduct assessments of external suppliers’ security posture and alignment with GreenPoint Energy and international cyber security standards.

Skills & Qualifications

• Experience with developing or maintaining a cyber security framework aligning with AESCSF and the SOCI Act will be preferred.
• Minimum 10 years relevant experience in cyber security.
• Good communication skills to ensure key business stakeholders are properly engaged.
• Experience in the energy and physical infrastructure sectors, including on site experience with operational energy assets, will be preferred.
• Able to communicate effectively (spoken and written) in English.
• Industry-recognised cyber certifications will be advantageous.