Principal IT Governance and Risk Consultant

PSEG Long Island is one of the largest energy companies in the country, offering a supportive work environment and flexible work options. The role is based in a hybrid flexible setting and involves a competitive salary range of $104,600 – $186,000. This position is a direct report to the Group Product Manager and focuses on technology enablement within the IT control assurance program.

This position is responsible for managing Vulnerability Management Remediation, IT Risk Management, Reporting & Metrics Management, and Governance & Process Improvement. The candidate will act as a subject‑matter expert and primary facilitator for product initiatives, anticipating issues, managing resources, and ensuring best practices are promoted across multiple technologies.

• Lead product teams in a matrix model to deliver business solutions around Vulnerability Management and Compliance.
• Serve as the primary point of contact for vulnerability management remediation, handling queries and escalations.
• Collaborate with IT teams to govern and enforce the IT Vulnerability Management process, including identifying, specifying, and analyzing vulnerability closures and maintaining progress throughout the lifecycle.
• Develop status updates, evaluate SLA adherence, and formulate plans, schedules, and escalation channels to meet or exceed SLA targets.
• Assess risks related to open vulnerabilities and implement mitigation strategies.
• Manage the vulnerability life‑cycle, including the risk acceptance process for residual vulnerabilities or risk items.
• Coordinate activities with IT departments, vendors, and other stakeholders to identify, negotiate schedules, milestones, and resources required to meet objectives.
• Escalate unresolved vulnerabilities in a timely manner and close any backlogs.
• Lead the development and maintenance of IT controls aligned with frameworks such as NIST, NERC, ISO, and SOX.
• Map regulatory, audit, and business requirements to control objectives and ensure ongoing compliance.
• Prepare management responses, remediation plans, and track closure of findings.
• Collaborate with IT Risk Management, Cybersecurity, and Audit teams to ensure controls support company objectives.
• Design and build processes for governance of IT vulnerability management, risk management, and compliance.
• Identify process gaps and recommend improvements to enhance efficiency and reduce operational risk.
• Define, track, and manage key performance indicators (KPIs) for IT business areas such as IT service management, Vulnerability Management, Application Management, and Infrastructure Management.
• Produce reports and dashboards on Vulnerability Management, SLA adherence, and IT operational metrics for senior leadership.
• Ensure quality through the use of company‑approved methodologies.

• Bachelor’s degree in Computer Science or a related technical field (STEM).
• Minimum six years of relevant work experience.
• Demonstrated leadership capabilities through projects or strategic initiatives.
• Experience in IT project management methodologies, requirements management, quality assurance, and IT processes.
• Broad knowledge of business functions, applications, and technology alternatives.
• Deep familiarity with regulatory and assurance frameworks: NIST CSF, NIST 800‑53, COBIT, NERC CIP, SOX.
• Strong knowledge of IT general controls, application controls, cybersecurity, and disaster recovery/business continuity.
• Strong understanding of Vulnerability Management processes, risk assessment methodologies, and SLA/KPI management & reporting.
• Experience with analytic tools for automated performance reporting and KPI management.
• Prior experience in IT governance, risk, and/or compliance.
• Strong analytical, verbal, written, facilitation, and escalation management skills.
• Ability to foster relationships with team members, IT management, and vendor teams.
• Solid understanding of technology platforms and ability to explain technical concepts.
• Demonstrated ability to measure process performance and identify constraints or escalation requirements.
• Working knowledge of specific technology areas and business process configuration for assigned domains.
• Requ…