Technology Engineer - Principal – ITS (SFPUC) - 1044 – (167654)

The SFPUC is seeking an experienced, strategic, and highly skilled Technology Engineer-Principal to serve as Cybersecurity Compliance Manager. Under the general direction of the Chief Information Security Officer (CISO), this position focuses on the compliance and governance aspects of the SFPUC cybersecurity program. The role assesses, tracks, reports on, and supports remediation of cybersecurity deficiencies across SFPUC technology and operational environments, working with Water, Wastewater, and Power enterprise stakeholders. This is a hybrid position that currently requires four days per week in the office and allows one remote workday per week.

Responsibilities

Manage the SFPUC cybersecurity Policies, Standards and Guidelines; Ensure alignment with COIT, the City's Office of Cybersecurity (DT), Office of Contract Administration (OCA) and Mayor's Executive Directives; Manage the SFPUC cybersecurity compliance program for Information Technology and Operational Technology within Enterprise Utilities; Track and report cybersecurity compliance to SFPUC internal policies and standards, including citywide policies and standards; Ensure regulatory and privacy compliance requirements are met; Facilitate and coordinate formal cybersecurity audit activities with the City Services Auditor, and track and report on remediation activities; Track and coordinate annual reporting activities; Manage compliance associated with emerging technologies such as AI or drones; Manage compliance with emerging regulations, including migration to .gov and accessibility; Manage compliance with SFPUC IT Policies, Standards and Guidelines; Manage compliance of video surveillance retention; Manage compliance of records management and data retention; Track emerging cybersecurity legislation that may impact the SFPUC through the rule-making process; Perform other related duties as assigned

Requirements

An associate degree in computer science, computer engineering, information systems, or a closely related field from an accredited college or university, or its equivalent in total course credits/units (at least 60 semester or 90 quarter credits/units, with a minimum of 20 semester or 30 quarter credits/units in one of the fields above or a closely related field); Five (5) years of experience analyzing, installing, configuring, enhancing, and/or maintaining the components of a system or platform; One year of additional experience as described above may be substituted for the required degree; Completion of the 1010 Information Systems Trainee Program may be substituted for the required degree; Applicants must meet the minimum qualifications by the final filing date unless otherwise noted

Nice to have

Utility industry experience; Demonstrated experience with NIST SP800-53, NIST CSF 2.0, NIST SP 800-82, NIST RMF, NIST AI RMF, IEC/ISO 62443, ISO 27001/27002, ISO 3000, America's Drinking Water Act (AWIA); Certified Ethical Hacker (CEH); Information Technology Infrastructure Library (ITIL); Microsoft Certified Professional/Security Engineer (MCP, MCSE); Cisco Certified Network Associate/Professional (CCNA, CCNP); Certified Information Security Manager (CISM); Project Management Professional (PMP); Understanding of application, database, network and systems security; Understanding of general computing controls (GCCs); Ability to identify complex control gaps; Understanding of generally applicable auditing standards and frameworks (e.g., COBIT), best practices for IT services management (e.g., ITIL), and regulatory standards (e.g., Sarbanes-Oxley Act, NERC/CIP)