Sr OT Systems Security Engineer

Who We Are:

We’re powering a cleaner, brighter future. Exelon is leading the energy transformation, and we’re calling all problem solvers, innovators, community builders and change makers. Work with us to deliver solutions that make our diverse cities and communities stronger, healthier and more resilient. We’re powered by purpose-driven people who believe in being inclusive and creative, and value safety, innovation, integrity and community service.

We are a Fortune 200 company with 19,000 colleagues serving more than 10 million customers across six energy companies – Atlantic City Electric (ACE), Baltimore Gas & Electric (BGE), Commonwealth Edison (Com Ed), Delmarva Power & Light (DPL), PECO Energy Company (PECO), and Potomac Electric Power Company (Pepco). In our relentless pursuit of excellence, we elevate diverse voices, fresh perspectives and bold thinking.

We provide competitive compensation, incentives, excellent benefits and the opportunity to build a rewarding career.

Primary Purpose of Position:

The Sr OT Systems Security Engineer (OTSSE) will support implementation of the Operational Technology (OT) Security Governance program and provide proactive cyber security risk management. The OTSSE will act as a liaison to OT teams, Security Architects and other CISS teams to effectively communicate and lead OT security engineering design specification, architecting and implementing effective OT security solutions. The OTSSE will also assist with vulnerability mitigation plans, incident response, and security event monitoring engineering support.

The OTSSE will ensure the implementation of OT security measures in accordance with established procedures to ensure safety, reliability, confidentiality, integrity, availability, authentication and non‑repudiation, and will perform OT security reviews to identify gaps in security design and architecture.

Note:
This is a hybrid position (in‑office with remote flexibility). Employees are required to be in office at least three days per week (Tuesday, Wednesday, and Thursday). This position must sit out of our Baltimore, MD, Newark, DE, Owings Mills, MD or Kennett Square, PA office. This position is NOT eligible for relocation assistance.

• Provide analytical and technical security recommendations to team members, technical teams and business clients, including OT cyber security guidance to leadership. Work with stakeholders to design OT security specifications and architectures. Provide input to implementation plans and SOPs as they relate to OT cyber security.
• Develop specific OT cyber security countermeasures and risk mitigation strategies for systems and/or applications.
• Work closely with technical teams to implement effective security configurations and requirements, including:
  • Analyze and design security measures to resolve OT vulnerabilities, mitigate risks and recommend security changes to system or components as needed.
  • Mitigate/correct security deficiencies identified during Factory Acceptance Testing, Site Acceptance Testing or recommend risk acceptance for appropriate senior leadership. Verify and update security engineering documentation reflecting the application/system security design features. Verify minimum security design specifications are in place for OT assets to support security event monitoring and incident response.
• Work closely with the R&D and innovation teams to ensure secure implementation of OT systems into production.
• Assist with vulnerability mitigation planning, incident response and security event monitoring engineering activities for security and compliance requirements.
• Conduct engagements and provide OT cyber security training to OT personnel.

The Senior OT Systems Security Engineer (OTSSE) will work primarily with business OT teams, IT/utility communications, engineering and OT clients to implement effective security configurations and requirements; provide analytical and technical security recommendations; support OT Security Governance; meet with Exelon business clients and management to help specify and negotiate system/network/application security…