Chief, IT and Cyber Risk Validation

Requisition # 167963

Job Category:
Compliance / Risk / Quality Assurance

Job Level: Director/Chief

Business Unit:
Gen Counsel, Ethics, Risk & Compliance

Work Type:
Hybrid

Job Location:

San Ramon

The Operational Risk Validation team is focused on assessing and validating risk mitigations and controls to determine the effectiveness of PG&E’s programs to address the highest risks for the enterprise. The goal is to confirm the right work is being done in a way that truly reduces risk, and to strengthen how we collectively quantify actual risk reduction based on units of work completed.

This team will partner closely with the existing risk, compliance, and operational groups, digging a few levels deeper beyond compliance. This will include observations in the field and dialogue with front-line employees to better understand operational risks, inform future risk reduction programs, and advocate for needed resources or support. Assessments and validations of risk-reducing work will be done for the top-tier enterprise risks, while responding to industry disruptors and emerging risk factors that may not fit neatly into existing risk frameworks.

These assessments and resulting recommendations will evaluate whether operations are meeting legal, regulatory, and other commitments – and beyond this, determine whether we’re truly reducing risk to an appropriate level.

Chief, IT and Cyber Risk Validation is an individual contributor who is responsible for ensuring that the risks associated with Cyber Security, Physical Security and Technology Improvements are effectively managed across the enterprise. This role will validate that the controls and mitigations are monitored, and all the stakeholders are engaged in data driven decision making. This individual will provide expertise on the key areas of risk for IT and Physical Security across the enterprise to build risk management capabilities.

The knowledge expected from this role are AI, Cloud, Data management, Cyber and Physical security, Asset management, Networking, IT infrastructure etc.

This is a high-level position focused on strengthening and building relationships across the organization in an area of risk that is continuously growing across all

Functional Area

s (FA). This position is hybrid, working from your remote office and your assigned work location based on business need. The assigned work location will be within the PG&E Service Territory.

This role reports to the Director, Operational Risk Validation Generation/ IT. This is an individual contributor role.

• Partners with Cybersecurity teams such as Asset Management, Strategy, Risk Assessment, Vulnerability Management, Security Intelligence and Operations Center etc. Validates the risk and ensures effectiveness on existing controls and mitigations on an ongoing basis.
• Partners with all asset owners and leaders across the enterprise to raise awareness, build support and partnership in the improvement of cyber asset data management across all technologies.
• Partners as the single point of contact within the Enterprise Risk and Compliance (ERC) team to ensure that technology and systems supporting cyber asset management are implemented and configured to ensure Cybersecurity of all assets across the Enterprise.
• Supports Cyber Security Asset Management strategy development and implementation to ensure external obligations are met across all regulators present and future.
• Partners with Enterprise Data Management, Physical Security and IT Infrastructure teams to set priorities and drive all risk- related activities managing the risks proactively.
• Primary thought leader for Enterprise Risk for development of the roadmap to Propel migration and mitigation strategies that support operational and strategic objectives of the ERC organization.
• Works directly with and coaches senior leadership in key operational areas to identify, address and communicate risk management issues, primarily focused on Cyber, Physical and IT risks.
• Recognizes and communicates internal and external developments that may impact risks based on in-depth knowledge of operational risks…