OT Cybersecurity GRC Analyst

At Motiva, our employees' energy, passion, and dedication to excellence are what make us who we are and what allows us to generate energy that makes a house a home, gets us from point A to point B, and enables our health and wellbeing. We invest in every aspect of our employees' lives because, at Motiva, our people matter.



Headquartered in Houston, Texas, Motiva refines, distributes and markets petroleum products throughout the Americas. The company's Port Arthur Manufacturing Complex in Port Arthur, TX, is comprised of North America's largest refinery with a total throughput of 720,000 barrels per day, the world's second largest base oil plant, and an integrated chemical plant. Under exclusive long-term brand licenses with Shell and Phillips 66 (for the 76® brand), Motiva's commercial operations supply more than 12 billion gallons of fuel to customers annually. Motiva is wholly owned by Aramco, one of the world's largest integrated energy and chemicals companies.



Position Overview:

The Operational Technology (OT) Cybersecurity Governance, Risk, and Compliance (GRC) Analyst plays a crucial role in ensuring the safety, security, and resilience of Motiva's OT and Industrial Control Systems (ICS) environments. This role demands a profound understanding of OT policies and standards, OT cyber risk management, and OT third-party risk management within the Oil and Natural Gas (ONG) industry.



Responsibilities:

• Lead the development and enhance the maturity of the OT third-party risk management program.
  
• Collaborate with OT/ICS vendors to ensure they meet security and compliance requirements.
  
• Monitor and report on the effectiveness of OT/ICS third-party risk mitigation measures.
  
• Conduct comprehensive risk assessments for OT/ICS systems and processes.
  
• Work closely with OT teams to develop and implement risk mitigation strategies.
  
• Support internal and external audits and maturity assessments.
  
• Assist with the development and alignment of Motiva OT policies, standards and procedures.
  
• Ensure OT systems comply with relevant regulatory requirements and standards.
  
• Stay current with industry standards, regulations, and best practices related to OT security.
  
• Collaborate with cross-functional teams to ensure alignment with organizational goals and objectives.
  

Experience and Qualifications Required:

Basic Qualifications:

• Bachelor's degree in a relevant field such as Information Security, Cybersecurity, Engineering, or 5 years of experience in cybersecurity with a focus on critical infrastructure protection.
  
• Experience conducting third-party risk assessments and supporting third-party risk management programs.
  
• Demonstrated experience developing OT cybersecurity policies, standards and procedures.
  
• Excellent communication and interpersonal skills.
  
• Relevant industry certifications including GICSP, CISSP, CRISC.
  

Preferred Qualifications:

• 5 years' experience in the ONG industry with a focus on third-party risk management.
  
• Experience developing and aligning OT policies, standards and procedures to C2M2.
  
• Knowledge of relevant regulations, standards and frameworks including NIST CSF, ISA 62443, C2M2.
  
• Comprehensive understanding of SCADA, Distributed Control Systems (DCS) and other OT/ICS technologies.