U.S. Department of Energy (DOE)

Organizational Effectiveness

Project Management

Strategy

Organizational Performance

Charles Schwab

Business Intelligence

Office of the Comptroller of the Currency

U.S. Commodity Futures Trading Commission

Strategic and Operational Planning

Federal Aviation Administration

Credit Risk Reporting & Analytics

Select Portfolio Servicing

Investor Reporting

Ocwen Financial Corporation - US

Helping you maximize your well-being without compromising your high-performance | deep life coach | transcendent leadership advisor

Steven Gurzenski

CSAA Insurance Group, a AAA Insurer

Director, Technology Risk Management

Xcel Energy

Senior Manager on the Enterprise Security & Emergency Management team which is responsible for management and oversight of Xcel Energy's security risk including cyber, physical, and resilience. Reporting to the Area Vice President (AVP) of Business Security Risk Advisory.

- Responsible for managing the risk advisory team that supports the IT organization. The team supports security needs for all IT projects (30-50 per year), conducts risk assessments, and conducts third party vendor risk assessments.

- Coordinate with over 15 Directors under 2 Vice Presidents in the IT office supporting IT deployments both on premises and in the cloud. Coordinate activities with the operations business units, responsible for Operational Technology (OT) projects.

- Manage a team of risk analysts and security engineers, overseeing risk management activities, setting individual and team goals, conducting performance reviews, and managing compensation.

- Supported revisions and updates to the enterprise security standards, working to move the organization towards security objectives and more effective risk management governance.

- Additional duty as the Core Functional Area Manager (CFAM) for Asset Management. Working across the enterprise to mature asset management capabilities to support security needs. In coordination with the business units, driving strategic vision and building a 5 year roadmap to define asset management requirements and associated capability needs.

Sr. Manager, Business Systems Security Risk Advisory Services

Western Area Power Administration

Enterprise Risk Manager in the Strategy Office responsible for monitoring and reporting enterprise risks for the enterprise. The Strategy Office team included, leads for Process Improvement, Change Management, and Performance Measurement. Together the team was also responsible for driving strategy and strategic initiatives. The team supported the senior leadership team (Administrator, Chief Operating Officer, Chief Financial Officer, and Regional Administrators).

- Reoriented the program to be Risk and Decision Support and operated as an internal consultant to advise on a number of high-profile initiatives spanning multiple business units. 

- Conducted a Factor Analysis of Information Risk (FAIR) assessment of specific cyber (SCADA) risk scenarios. Successfully quantified the impact and likelihood using Monte Carlo simulations to estimate annual loss exceedance of scenarios and estimate risk reduction of additional controls.

- Developed a decision framework for use internally to improve decision quality, including development of internal SharePoint site for training materials and templates. 
  
- Worked in partnership with business units and the senior leadership team, responsible for identifying and assessing enterprise risks from across the Western Area Power Administration (WAPA) regions. 

- Annually provided an enterprise risk profile to the Department of Energy. Worked closely with Internal Audit and Compliance teams to improve organizational Governance, Risk, and Compliance (GRC) capabilities.

- Through the other team members, trained in Process Improvement, Organizational Change Management, and Performance Measurement.

Enterprise Risk Manager

Deloitte

Manager in Advisory Cyber Risk Services group at Deloitte. 

-Supported the implementation of NERC Critical Infrastructure Protection (CIP) Standards, version 5, across a large investor owned utility with multiple business units.

-Planned future compliance implementation of Low Impact Asset and Transient Device requirements.

-Developed an integration roadmap and supported "Day-1" readiness for the cybersecurity programs of two companies during a corporate merger.

Manager, Technology Risk Management

North American Electric Reliability Corporation

Cybersecurity Specialist at the Electricity Subsector Information Sharing and Analysis Center (ES-ISAC) within NERC. Facilitated the exchange of threat and vulnerability information between the government and private sector partners. Conducted risk assessments, evaluations, and analysis for the electricity subsector. 

-Program Manager for the Cybersecurity Risk Information Sharing Program (CRISP). Established the CRISP program from inception in partnership with the Pacific Northwest National Laboratory (PNNL). The program allows for cybersecurity data sharing across dozens of companies with centralized analysis.

-Built the partnership with the initial cohort of utilities which established the CRISP program. Worked with the legal team to negotiate the legal agreement for the program, managed the budget, and deployed CRISP capability to 12 utilities across the country. 

- Facilitated Cyber Risk Preparedness Assessments (CRPA) exercises. One day facilitated exercises designed to test an organization's cybersecurity program, specifically cybersecurity incident management. 

-Supported the development of the NIST Cybersecurity Framework (CSF) through the development workshops.

Cybersecurity Specialist, ES-ISAC

U.S. Department of Energy

Infrastructure Systems Analyst in the Office of Electricity Delivery and Energy Reliability, Infrastructure Security and Energy Restoration. 

- Program Manager for the Electricity Sector Cybersecurity Capability Maturity Model (ES-C2M2) program. The ES-C2M2 was developed as part of a White House initiative led by DOE in partnership with DHS and industry.

-Transitioned the ES-C2M2 program from a pilot phase to a sustained program and conducted 12 facilitated engagements with electric power utilities to assess their maturity level.

- Project lead for the Electricity Sector Cybersecurity Risk Management Process (RMP) guideline development. Wrote and published the RMP in collaboration with NIST, NERC, the Department of Homeland Security (DHS) and industry technical experts.

- Oversight of contractor support, developing project timelines, coordinating resources, monitoring budget, and tracking milestones

- Supported DOE emergency response efforts in support of the Federal Emergency Management Agency 

- Certified as a Contract Officer Technical Representative and functioned as a task monitor for execution of contract support

Infrastructure Systems Analyst

MITRE

Promoted to first line supervisor within one year, responsible for contract execution and a team of five supporting the DHS Office of Infrastructure Protection, Partnership and Outreach Division

Developed project and activity plans to redefine the mission for the Infrastructure Coordination and Analysis Office 

Developed incident management guidance documents for electric sector response activities 

Developed risk management decision support tools for nuclear sector

Senior Multi-Discipline Systems Engineer

Homeland Security Institute

Clients: DHS Policy Office, DHS Science and Technology Directorate, DHS FEMA

Onsite analyst in the Office of Strategic Plans, DHS Policy Office, developing the Quadrennial Homeland Security Review 

Worked with the Integrated Product Teams for the Science and Technology Directorate developing and applying a programmatic assessment methodology 

Supported the drafting of the revision to the National Incident Management System (NIMS)

Senior Associate Analyst

Intern

DFI International Government Services

Conducted in-depth analysis and client briefings of energy sector critical infrastructure vulnerabilities including development and application of energy grid vulnerability methodology

CLIFTON STRENGTHS
Strategic / Learner / Responsibility / Intellection / Adaptability

I've spent my career working in the risk management, infrastructure protection, and information security domains, working to improve organizations' security posture and manage risk. My focus has been critical infrastructure - those industries that are foundational to our nation's security and economic stability. 

As a risk management practitioner, I focus on risk management as a decision support tool. I find that part of the challenge is understanding what decisions the organization is trying to make. Understanding the "what" and "why" can drive clarity and allows one to build a risk management program tailored to the organization's needs. Importantly, risk management (in any domain) requires the ability to effectively communicate and coordinate with risk owners and stakeholders. 

I appreciate organizations that have a strong culture and value a diverse and inclusive workforce. As the saying goes, "culture eats strategy for breakfast" and in my experience that holds true. Outside of work I enjoy everything that Colorado and the Rocky Mountains have to offer. Hiking and skiing are my favorite outdoor activities. During the week I run, bike, and swim.

Matthew Light

taplio

The Battle

Steven Gurzenski

Matthew Light

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?