Cybersecurity Governance, Risk, & Compliance Analyst (Principal Administrative Analyst) – Cybersecurity - ITS - SFPUC (1824) 133942

Cybersecurity Governance, Risk, & Compliance 1824 Principal Administrative Analyst

Location: 525 Golden Gate Ave, San Francisco, CA 94102, USA

Standard Business Hours: (Monday – Friday/ 8am – 5pm)

---

POSITION DESCRIPTION

Under the general direction of the Chief Information Security Officer (CISO), this Principal Administrative Analyst will be focused on the Governance, Risk & Compliance (GRC), Awareness & Training, Audits and Reporting aspects of the cybersecurity program.

This Cybersecurity Analyst is responsible for monitoring cybersecurity industry standard practices to ensure the safety, secure and resilient IT and OT (Operational Technology) environments at the San Francisco Public Utilities Commission (SFPUC). In this role, the Cybersecurity Analyst will assist with the coordination of cybersecurity activities and collaborate Agency-wide and ensure alignment with external policymakers.

In addition to cybersecurity knowledge, this role requires business acumen. Including the ability to collaborate internally Agency-wide and within the larger Citywide cybersecurity ecosystem.

Essential functions of this position include

• Manage the SFPUC cybersecurity Policies, Standards, and Guidelines to ensure the SFPUC cybersecurity expectation are effectively communicated. Ensure alignment with the COIT (Committee on Information Technology), the City’s Office of Cybersecurity (DT), Office of Contract Administration (OCA) and Mayor’s Executive Directives.
• Manage the SFPUC cybersecurity Risk Management program including the risk tracking, reporting and exception aspects. In addition, facilitating the Risk Advisory Services, Risk Assessment and Vendor Risk Assessments processes in alignment with both the SFPUC’s Enterprise Risk Management, City Risk Managers cybersecurity insurance program and the City’s Office of Cybersecurity’s Risk Management program.
• Manage the SFPUC cybersecurity compliance program. Track and report compliance to the SFPUC, COIT, OCA and the City’s Office of Cybersecurity’s Authority Documents (Policy & Standards). Ensure regulatory compliance.
• Facilitate the coordinate formal cybersecurity audit activities as the audit. Track and report on remediation activities.
• Ensure alignment to the COIT Security Awareness & Training Policy. Coordinate the Annual Training including the tracking and reporting. Administer the Security Awareness Technologies. Identify higher risk staff that could benefit from additional training.
• Track and Coordinate Annual Reporting Activities.
• Track and Coordinate Metrics and the CISO Dashboard. Ensure Metrics drive the Cybersecurity Strategic Planning activities along with coordinating the Cybersecurity biennial financial planning activities.

The 1824 Principal Administrative Analyst will perform other related duties as assigned.