[Hiring] Senior Subject Matter Expert, Equivalency @OneZero Solutions

Role Description

The Senior SME, Equivalency is the program's senior technical authority for operational technology and industrial control system cybersecurity in the maritime domain. This position conducts the technical review of all equivalency requests submitted under 33 CFR Part 101 Subpart F and assists with complex waiver requests and cybersecurity plan reviews as assigned. This is a designated Key Personnel position; the Government must acknowledge any replacement in writing.

Key Responsibilities

• Conduct the detailed technical review of all equivalency requests, evaluating whether the request clearly identifies the regulatory requirement at issue, describes the proposed alternative safeguard, and provides sufficient supporting evidence for Government evaluation.
• Determine whether the proposed alternative provides a level of security that meets or exceeds the effectiveness of the specified regulatory requirement, and document that analysis so it is technically supportable and traceable.
• Apply Government-furnished methodologies, checklists, process guides, and decision matrices to produce preliminary recommendations of Approve, Approve with Conditions, or Deny.
• Prepare consolidated review packages for the USCG representative, including the complete request with supporting documentation, the fully annotated checklist with scoring, and a draft technical analysis.
• Draft signature-ready correspondence addressed to submitters for USCG review and signature, including supporting justification and any proposed conditions for Government consideration.
• Assist with complex and novel waiver requests and cybersecurity plan technical reviews as assigned by the Project Manager and Sub-Project Managers.
• Serve as the senior technical escalation point for OT and ICS questions raised by both review teams.
• Perform quality control to ensure findings are clearly stated, technically supportable, internally consistent, and traceable to the applicable regulatory requirement or checklist element.
• Support development and delivery of internal maritime and OT cybersecurity training for review personnel.
• Recommend improvements to review processes, checklists, and templates for Government consideration, without establishing approval criteria or adjudication standards independent of the Government.

Qualifications

• Seven (7) years of hands-on experience focused on OT/ICS cybersecurity.
• Expert-level knowledge applying cybersecurity frameworks such as NIST CSF and ISA/IEC 62443 specifically to OT/ICS environments.
• Expert-level understanding of OT network architecture and security controls, with demonstrated capability applying that knowledge to maritime systems such as vessel navigation systems, cargo handling systems, and facility automation.
• At least one cybersecurity certification satisfying the certification requirement for the DoD 8140 DCWF work role of Security Control Assessor (for example CISSP, CISA, or CISM).
• At least one advanced OT-focused cybersecurity certification, such as the Global Industrial Cyber Security Professional (GICSP).
• Must disclose, for organizational conflict of interest screening, any current or prior engagement performed for MTSA-regulated vessel, facility, or Outer Continental Shelf facility owners or operators involving cybersecurity plan development, cybersecurity assessment, or related advisory services.

Preferred Qualifications

• Additional OT and ICS certifications such as GRID, GCIP, or ISA/IEC 62443 credentials.
• Prior U.S. Coast Guard, DHS, or MTSA regulatory experience.
• Experience with Alternative Security Programs (ASPs) in the maritime sector.
• Experience serving as an independent assessor or auditor against a published control set or checklist.
• Experience authoring technical justifications or equivalency determinations for a regulator.

Technical Skills

• OT and ICS network architecture, segmentation, and security control design.
• Industrial and maritime protocols, including Modbus, DNP3, OPC UA, NMEA 0183/2000.
• Maritime systems including ECDIS, AIS, GNSS, cargo and ballast control, terminal operating systems, and crane and facility automation.
• NIST Cybersecurity Framework and NIST SP 800-series risk management guidance.
• ISA/IEC 62443 series.

Education

• Bachelor's degree in engineering, computer science, cybersecurity, or a related technical field preferred. Equivalent hands-on OT/ICS experience will be considered in lieu of a degree.

Benefits

• Highly competitive benefits package, including health, dental, vision, and life insurance.
• 401(k) with company matching.
• Paid time off and holidays.
• Employee referral program.
• Educational assistance.