Technology Engineer - Principal – ITS (SFPUC) - 1044 – (167654)

Job Description

Project name: Cybersecurity Compliance Program Implementation

San Francisco Public Utilities Commission (SFPUC) is seeking an experienced, strategic, and highly skilled Technology Engineer-Principal to serve as Cybersecurity Compliance Manager. Under the general direction of the Chief Information Security Officer (CISO), this position is focused on the compliance and governance aspects of the SFPUC cybersecurity program.

The Cybersecurity Compliance Manager is responsible for leading and coordinating activities that assess, track, report on, and support the remediation of cybersecurity deficiencies across SFPUC’s technology and operational environments. This role works closely with Water, Wastewater, and Power enterprise stakeholders to ensure compliance with applicable cybersecurity regulations, legislation, directives, standards, and internal policies. The position supports the implementation and continuous improvement of cybersecurity governance, risk, and compliance (GRC) processes designed to strengthen the organization’s security posture and reduce cybersecurity risk.

As a cybersecurity leader, the Cybersecurity Compliance Manager collaborates with business and technology stakeholders across the SFPUC and the broader City and County of San Francisco cybersecurity ecosystem to promote consistent compliance practices, facilitate risk-informed decision-making, and support enterprise cybersecurity objectives. Responsibilities include coordinating compliance assessments and audits, monitoring corrective action plans, developing and maintaining cybersecurity policies and standards, tracking regulatory and legislative requirements, preparing compliance reports and metrics, and advising management on cybersecurity compliance and risk management matters.

In addition to strong cybersecurity expertise, this position requires sound business acumen, strategic thinking, and the ability to build effective partnerships across diverse operational and technical organizations. The Cybersecurity Compliance Manager serves as a trusted advisor to leadership and stakeholders, helping align cybersecurity compliance activities with organizational priorities, regulatory obligations, and the SFPUC’s mission of delivering essential public services securely and reliably.

This is a hybrid position that currently requires four days per week in the office and allows one remote workday per week.

Essential Functions:

• Manage the SFPUC cybersecurity Policies, Standards and Guidelines to ensure the SFPUC cybersecurity expectations are effectively communicated.
• Ensure alignment with the COIT (Committee on Information Technology), the City’s Office of Cybersecurity (DT), Office of Contract Administration (OCA) and our Mayor’s Executive Directives.
• Manage the SFPUC cybersecurity compliance program for Information Technology and Operational Technology within our Enterprise Utilities.
• Track and report cybersecurity compliance to SFPUC internal policies & standards, including citywide policies and standards published by COIT, OCA and the citywide City’s Office of Cybersecurity.
• Ensure regulatory and privacy compliance requirements are met.
• Facilitate the coordinate formal cybersecurity audit activities with City Services Auditor (independent auditor). Track and report on remediation activities.
• Track and Coordinate Annual Reporting Activities, as required.
• Manage compliance associated with Emerging Technologies like AI or drones.
• Manage compliance with Emerging Regulations requiring changes like the migration to .gov and Accessibility.
• Manage compliance with SFPUC IT Policies, Standards and Guidelines to ensure the SFPUC IT expectations are effectively communicated.
• Manage compliance of Video Surveillance retention.
• Manage compliance of Records Management and Data Retention.
• Track emerging Cybersecurity legislation that may impact the SFPUC through the rule making process with the help and support of the SFPCU legislative team.
• The 1044 Technology Engineer - Principal will perform other related duties as assigned.

Qualifications

Education:

An associate degree in computer science, computer engineering, information systems, or a closely related field from an accredited college or university OR its equivalent in terms of total course credits/units [i.e., at least sixty (60) semester or ninety (90) quarter credits/units with a minimum of twenty (20) semester or thirty (30) quarter credits/units in one of the fields above or a closely-related field].

Experience:

Five (5) years of experience analyzing, installing, configuring, enhancing, and/or maintaining the components of a system or platform.

Substitution:

One year of additional experience as described above may be substituted for the required degree.

Completion of the 1010 Information Systems Trainee Program may be substituted for the required degree.

Applicants must meet the minimum qualification requirement by the final filing date unless otherwise noted.

Desirable Qualifications:

• Utility industry experience
• Demonstrated experience with National Institute of Standards and Technology (NIST) SP800-53, NIST CSF 2.0, NIST SP 800-82, NIST SP 800-53, NIST RMF, NIST AI RMF, IEC/ISO 62443 IS0 27001/27002, ISO 3000, Americas Drinking Water Act (AWIA)
• Certified Ethical Hacker (CEH)
• Information Technology Infrastructure Library (ITIL)
• Microsoft Certified Professional/Security Engineer (MCP, MCSE)
• Cisco Certified Network Associate/Professional (CCNA, CCNP)
• Certified Information Security Manager (CISM)
• Project Management Professional (PMP)
• Understanding of application, database, network and systems security
• Understanding of general computing controls (GCCs)
• Ability to identify complex control gaps.
• Understanding of generally applicable and accepted auditing standards and framework (e.g. COBIT) and best practices for IT services management (e.g., ITIL), regulatory standards and requirements (e.g. Sarbanes Oxley Act, NERC/CIP,)

The stated desirable qualifications may be considered at the end of the selection process when candidates are referred for hiring.

Additional Information

Applicants may be required to submit verification of qualifying education and experience at any point during the recruitment and selection process. If education verification is required, information on how to verify education requirements, including verifying foreign education credits or degree equivalency, can be found at https://sfdhr.org/how-verify-education-requirements

Note: Falsifying one’s education, training, or work experience or attempted deception on the application may result in disqualification for this and future job opportunities with the City and County of San Francisco.

All work experience, education, training and other information substantiating how you meet the minimum qualifications must be included on your application by the filing deadline. Information submitted after the filing deadline will not be considered in determining whether you meet the minimum qualifications.

Resumes will not be accepted in lieu of a completed City and County of San Francisco application.

Applications completed improperly may be cause for ineligibility, disqualification or may lead to lower scores.

Additional Information Regarding Employment with the City and County of San Francisco:

• Information About the Hiring Process
• Conviction History
• Employee Benefits Overview
• Equal Employment Opportunity
• Disaster Service Worker
• ADA Accommodation
• Veterans Preference
• Right to Work
• Copies of Application Documents
• Diversity Statement

HOW TO APPLY

Applications for City and County of San Francisco jobs are only accepted through an online process. Visit https://careers.smartrecruiters.com/CityAndCountyOfSanFrancisco1/ and begin the application process.

• Select the “I’m Interested” button and follow instructions on the screen

…