Corporate Security Compliance Coordinator

Corporate Security Compliance Coordinator

Responsible for developing, designing, maintaining and managing Corporate Security programs, policies, procedures and plans in order to maintain compliance to the North American Electrical Reliability (NERC) Critical Infrastructure Protection (CIP) Reliability Standards related physical security requirements. Monitors Corporate Security operations to ensure compliance with CIP Standards, coordinates compliance risk assessments with other business units, and assists in implementing recommended remedies. Interprets CIP physical security standards and requirements and supports the implementation of these requirements. Work with other business units to ensure compliance at all facilities system-wide.

Minimum Requirements: Associate's Degree in Criminal Justice or related field and 3 years' work experience in a Corporate Security, Nuclear Security, Regulatory or law enforcement environment OR High School Diploma and 5 years directly related work experience. Position requires a good understanding of APS business operations, processes and business unit(s) systems utilized within the organization. Technical experience relating to APS business and physical security systems is preferred.

Major Accountabilities:

• Oversee the planning, development, implementation and maintenance of compliance-related physical security plans, training, policies and procedures specifically associated with the CIP physical security standards as they apply to the bulk electric system. Monitor Corporate Security CIP efforts to ensure compliance with federal regulations. Perform risk/gap assessments and develop and implement internal controls to mitigate compliance risk. Conduct self-assessments and make changes as needed.
• Participate as a company representative in various forums, committees and working groups as it relates to compliance, department, or company issues. Assess industry standards, practices, and other utilities' efforts in order to implement program or policy changes accordingly. Update the Security Director of key issues, concerns or opportunities regarding the compliance program, its stakeholders, or the industry at large.
• Represent the Company's position, either internally or through direct testimony, with WECC/NERC/FERC (Federal Energy Regulatory Commission) regulators, industry, trade organizations (i.e. Edison Electric Institute, North American Energy Standards Board, North American Transmission Forum, various working groups, etc.)
• Partner with Information Technology and/or lead small scope projects involving process/system improvements and special technology needs. May participate and contribute to projects that have moderate or complex scope and budget.
• Provide daily oversight of the Critical Infrastructure Protection (CIP) physical security program including, but not limited to, the following activities; coordinate alternative compliance measures during physical security system outages, manage, analyze and retain compliance artifacts such as logs, access lists, and other compliance related documentation, provision/de-provision physical access as necessary, and develop employee training.
• Maintain compliance documentation/evidence in appropriate corporate and business unit document management systems. Ensure that all compliance documentation/evidence is current, complete, accurate and in compliance with applicable regulatory requirements.
• Provide expertise in the planning, development, and implementation of physical security protections for new and existing CIP locations.
• Monitor the Identity Access Management (IAM) for CIP related physical security access revocations in order to maintain compliance with CIP standards in required timeframe.
• Assist Information Technology with technical reviews of physical security equipment to ensure equipment is functioning properly, that it meets regulatory requirements and that it is adequately maintained to provide protection to employees and company assets.
• Conduct site inspections, assessments and audits to ensure full regulatory compliance. Act as a subject matter expert during regulatory audits.
• Conduct training on programs, policies, procedures and plans as they relate to regulatory driven physical security requirements.
• Serve as the Business Unit CCURE System Administrator, managing system configuration, user provisioning, access control privileges and compliance with Corporate Security standards.

Export Compliance / EEO Statement: This position may require access to and/or use of information subject to control under the Department of Energy's Part 810 Regulations (10 CFR Part 810), the Export Administration Regulations (EAR) (15 CFR Parts 730 through 774), or the International Traffic in Arms Regulations (ITAR) (22 CFR Chapter I, Subchapter M Part 120) (collectively, 'U.S. Export Control Laws'). Therefore, some positions may require applicants to be a U.S. person, which is defined as a U.S. Citizen, a U.S. Lawful Permanent Resident (i.e. 'Green Card Holder'), a Political Asylee, or a Refugee under the U.S. Export Control Laws. All applicants will be required to confirm their U.S. person or non-US person status. All information collected in this regard will only be used to ensure compliance with U.S. Export Control Laws, and will be used in full compliance with all applicable laws prohibiting discrimination on the basis of national origin and other factors. For positions at Palo Verde Nuclear Generating Stations (PVNGS) all openings will require applicants to be a U.S. person. Pinnacle West Capital Corporation and its subsidiaries and affiliates ('Pinnacle West') maintain a continuing policy of nondiscrimination in employment. It is our policy to provide equal opportunity in all phases of the employment process and in compliance with applicable federal, state, and local laws and regulations. This policy of nondiscrimination shall include, but not be limited to, recruiting, hiring, promoting, compensating, reassigning, demoting, transferring, laying off, recalling, terminating employment, and training for all positions without regard to race, color, religion, disability, age, national origin, gender, gender identity, sexual orientation, marital status, protected veteran status, or any other classification or characteristic protected by law. For more information on applicable equal employment regulations, please refer to EEO is the Law poster. Federal law requires all employers to verify the identity and employment eligibility of every person hired to work in the United States, refer to E-Verify poster. View the employee rights and responsibilities under the Family and Medical Leave Act (FMLA). In compliance with the Drug Free Workplace Act of 1988, the Company is committed to a work environment that is free from the effects of alcohol and controlled substances, and free from the abuse or inappropriate use of prescribed and over-the-counter medications. The Company requires employees to be subject to drug and alcohol testing that is job-related and consistent with business necessity, regulatory requirements and applicable laws.

CIP Requirement: This position requires Critical Infrastructure Protection (CIP) access consistent with North American Electric Reliability Corporation (NERC) standards. The applicant considered for this role will be required to obtain and maintain CIP access for the duration of employment in this position. A full seven (7) year criminal history will be obtained through the pre-employment background check process (or, for current employees, through supplemental background check process) to fulfill the CIP access requirements. In addition, this position requires an additional background check every seven years to maintain access. Hybrid: Employees in hybrid roles work both in their home offices (virtually) and alongside their colleagues (in person). In order for employees to build strong relationships and to promote meaningful in-person interactions, hybrid employees are expected to work about 40% of their time in-person at an APS or other (non-home office) location. Employees are expected to reside in Arizona (or New Mexico for Four Corners-based employees). Working from a home office requires adequate technology and an appropriate ergonomic set up. Role types are subject to change based on business need.