Item

Accountability

%

1

Lead a geographically diverse team providing direction, management oversight, performance appraisals, and mentoring, career development; promote diversity and teamwork with other Security groups. Perform vendor management of associated Cyber Vulnerability platforms and solutions. May require travel up to 10%.

20

2

Develop and maintain annual vulnerability assessment schedule through interaction with business units, project management, emergent assessments and inclusion of business critical applications requiring predefined assessment requirements. Support and maintain a remediation tracking solution, enforcing accountability through final resolution. Ensure plans of actions and milestones or remediation plans are in place for vulnerabilities identified during vulnerability assessments.         Management of Security Patch Management and Vulnerability Management processes and enforcement.   Measure the effectiveness of the enterprise's cybersecurity safeguards to ensure they provide the intended level of protection.

40

3

Manage Vulnerability Threat and Industrial Control Systems notifications of emergent vulnerabilities ensuring remediation tracking.

10

4

Oversee supporting security related functions, processes, and engagement to include Firewall risk assessment and Data Loss Prevention. Maintain monthly reporting to senior Security management and Business Units for all Vulnerability Management responsibilities.

10

5

Lead and manage NERC CIP vulnerability assessment program and requirements that include active or paper based assessments, project management, adherence to reporting standards, enforcement of security compliance standards and remediation tracking.

10

6

Establish, maintain, and enhance relationships with business and IT partners.  Communicate status to

Key stakeholders on a regular basis.

10

Minimum:

Preferred:

• Bachelor’s Degree in Computer Science, Information Technology (IT), Security Management or a related discipline, and typically 8 or more years of experience in cyber security, vulnerability management or equivalent combination of education and work experience.

• Graduate degree in cyber security or related area of expertise.
• Relevant security certifications (CISSP, CISM or CISA; CEH or GIAC)

• Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins
• Knowledge of system life cycle management principles, including software security and usability
• Knowledge of new and emerging information technology (IT) and cybersecurity technologies
• Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth)          
• Knowledge of host/network access control mechanisms (e.g., access control list)
• Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services
• Knowledge of penetration testing principles, tools, and techniques
• Knowledge of system and application security threats and vulnerabilities
• Knowledge of resource management principles and techniques
• Knowledge of information security program management and project management principles and techniques
• Knowledge of cyber threats and vulnerabilities.           

• Demonstrated experienced in Vulnerability Management processes including remediation tracking and resolution
• Demonstrated experience managing vulnerability assessment schedules that span across all business units, functions, and platforms
• Demonstrated experience with standard security tools that include, but are not limited to, Nessus, Rapid7, Qualys, Metasploit, and Nipper
• Demonstrated experience managing Security Patch Management  engagements with support teams, developing risk evaluation, remediation planning, and validation
• Demonstrated experience managing recurring  vulnerability identification processes through scanning, notification, assisting with remediation requirements and validation
• Experience managing firewall risk evaluation, providing support and describing alternatives to reduce risk exposure
• Demonstrated experience managing Vulnerability Threat notification and analysis process, including daily reviews of emergent vulnerability threats that have an impact on the Exelon environment
• Demonstrated experience supporting emergent threat intelligence through the use of security scanning tools, determining applicability and impact on the infrastructure
• Experience managing Data Loss Prevention (DLP) policies, DLP incident resolution, providing support for Legal investigatory requests, providing monthly metrics reporting

• Experience managing budget development and forecasting

• Enforcement of change management techniques associated with Cyber Security Vulnerability Management enhancements

• Managing approvals of changes affecting NERC CIP infrastructure

• Demonstrated leadership ability

• Excellent oral/written communication skills and the proven ability to work effectively with all levels of IT and business management