Energy Utilities IT

IND06: Energy & Utilities IT Careers — Deep Dive

Published: 2026-04-30
Updated: 2026-04-30
Scope: Electric utilities, oil & gas, nuclear, renewable energy, water utilities, mining
Geographic focus: North America + South Africa context

Executive Summary

Energy and utilities IT spans one of the most heavily regulated, critical-infrastructure-focused industries on Earth. Whether you work for an electric utility managing the bulk electric system (BES), an oil & gas operator running SCADA-coordinated upstream/midstream/downstream platforms, a renewable-energy facility ensuring grid compliance, or a water utility defending against EPA-mandated cybersecurity controls, you'll encounter:

• Specialized ICS/OT security (not just IT): GIAC GICSP, GIAC GRID, GIAC GCIP certifications; NERC CIP standards (CIP-002 through CIP-015); TSA pipeline directives; EPA Safe Drinking Water Act (SDWA) § 1433 compliance
• Industry-specific software stacks: AVEVA PI System (real-time data), SAP IS-Utilities, Oracle Utilities, IBM Maximo for asset management; Allegro ETRM (energy trading/risk)
• Regulatory breadth: NERC (North American Electric Reliability Corporation), FERC (Federal Energy Regulatory Commission), NRC (Nuclear Regulatory Commission), DOE, EPA, PHMSA (pipeline hazmat), TSA
• Career leverage: Salaries 5–15% above IT generalist roles; demand outpaces supply; international and regional variation (South Africa's Eskom, Sasol; US utilities; oil majors)

This vertical is ideal for IT professionals seeking high-impact, highly-regulated, geographically-diverse opportunities with strong salary floors and deep technical specialization.

1. Industry Landscape

1.1 Subsectors

1.2 Why IT is Critical

• Reliability: Electric grid failures cost ~$50B/year in lost economic output (2003 Northeast blackout lasted ~1 hour, cost ~$6B). Every minute matters.
• Regulatory exposure: NERC CIP violations can incur fines up to $1M/day. EPA SDWA § 1433 violations are now being enforced (70% of inspected water systems non-compliant as of 2024).
• Cyber-physical risk: Unlike IT-only breaches (data theft), OT attacks can cause explosions, electrocution, water contamination, grid cascades—life-safety consequences.
• Modernization pressure: Aging grid (average US transmission asset is 40+ years old); renewable integration adding complexity; EV charging load growth; climate-driven peak shifting.

2. Regulatory & Standards Landscape

2.1 NERC CIP (Critical Infrastructure Protection)

NERC CIP standards establish baseline cybersecurity requirements for the North American bulk electric system. All NERC-registered entities must comply. Standards are free PDFs on NERC Standards.

Approved 2024–2025 updates:

• CIP-003-11 (proposed Dec 2024): MFA for remote access; authentication info protection; malicious comms detection for low-impact systems with external routable connectivity.
• CIP-015-1 (approved June 2025, FERC Order No. 907): Extends INSM to all high/medium-impact systems regardless of external connectivity.

Citation: NERC CIP Standards — Official Index; FERC Order No. 907 (CIP-015-1 approval)

2.2 Bulk Electric System (BES) & BCSI

BES Cyber System Information (BCSI) = any electronic record(s) containing information used in the planning, design, operation, or security of the BES.

Examples:

• System architecture diagrams, network maps, control logic
• Vendor datasheets, device credentials, firmware versions
• Threat assessments, vulnerability scans, incident details

Handling requirement: BCSI must be protected with equivalent rigor to military classified data (encryption, secure transport, limited access). Mishandling or leakage is treated as a compliance incident.

Career implication: Many utilities hire BCSI handlers (data stewards), NERC compliance coordinators, and document custodians—roles that bridge IT security and business operations.

2.3 Federal Agencies

Citation: TSA Pipeline Security Directives (2024 updates); EPA SDWA § 1433 Guidance (2024); FERC Order No. 907

2.4 TSA Pipeline Cybersecurity Directives (Post-Colonial Pipeline, 2021–2025)

Following the Colonial Pipeline ransomware attack (May 2021), TSA issued two security directives requiring pipeline operators to:

1. Report cyber incidents to CISA within 24 hours (now standing requirement).
2. Designate a 24/7 cybersecurity coordinator available to liaise with TSA & CISA.
3. Conduct vulnerability assessments, identify gaps, develop remediation timeline.

Current directives (as of April 2026):

• Security Directive Pipeline-2021-01D (effective May 29, 2024; expires May 29, 2025).
• Security Directive Pipeline-2021-02E (effective July 27, 2024; expires July 27, 2025).

2024 Notice of Proposed Rulemaking (NPRM): TSA is formalizing directives into permanent rules, incorporating NIST Cybersecurity Framework and CISA cross-sector cybersecurity performance goals (e.g., MFA, encryption, EDR).

Career implication: Pipeline operator roles ("Control Room Operator," "Systems Engineer") now require cybersecurity awareness. Compliance managers and GRC specialists are in high demand.

Citation: TSA Press Release (July 2024); GAO-25-107947: Pipeline Cybersecurity Analysis

2.5 EPA SDWA § 1433 (Drinking Water Cybersecurity)

Starting in 2024, EPA began enforcing Safe Drinking Water Act (SDWA) § 1433 cybersecurity requirements. Inspection findings show alarming gaps:

• 70% of inspected water systems non-compliant (as of March 2024 EPA enforcement alert).
• Common failures: default credentials not changed, employee access not revoked, no risk assessments, no incident response plans.
• Real incident (2024): Russia-affiliated hacktivist group remotely accessed SCADA system at Muleshoe, Texas water utility, causing water tank overflow (~40 min).

SDWA § 1433 requirements:

• Risk & Resilience Assessments (electronic/cyber systems included).
• Emergency Response Plans.
• Cybersecurity incident response coordination with state/federal agencies.
• Documentation of compliance.

Resource constraint: Only 20% of US water/wastewater systems have basic cyber hygiene; most are under-resourced and lack dedicated cybersecurity staff.

Career opportunity: Water utilities are actively hiring cybersecurity engineers, SCADA engineers, risk assessors—often with 15–25% salary premium over municipal IT generalists.

Citation: EPA Cybersecurity Guidance (2024); EPA Enforcement Alert (March 2024); CISA Water Sector Resources

3. ICS/OT Security & Certifications

Energy/utilities IT is not purely IT—it's Operational Technology (OT) security. Mandatory certifications:

3.1 GIAC ICS/OT Certifications

All three are endorsed by:

• U.S. Department of Defense (DoD)
• Department of Homeland Security (DHS)
• Department of Energy (DOE)

Citation: GIAC GICSP; GIAC GRID; SANS ICS410; SANS ICS456

3.2 ICS-Specific Protocols & Standards

Energy/utilities systems rely on decades-old, standardized communications protocols optimized for reliability, not speed:

Career note: Engineers who understand legacy Modbus/DNP3 AND modern OPC UA are rare and command premium salaries. Many utilities are mid-retrofit, needing bilingual engineers.

Citation: IEC 61850 Standard; DNP3 IEEE 1815-2012; NIST SP 800-82 Guide to ICS Security

4. Energy-Specific Technology Stacks

4.1 Real-Time Data & Operational Intelligence

AVEVA PI System (formerly OSIsoft PI)

Market position: De facto industry standard for real-time industrial data. Acquired by AVEVA in 2021 ($5B deal). Powers ~1,000+ utilities, 38 of Fortune 40 oil/gas companies, all Fortune 10 metals/mining companies.

Use: Ingests time-series data from sensors, PLCs, DCS; stores, analyzes, visualizes for operations & analytics. Example: a coal plant collects 100k data points/second (temperature, pressure, flow, vibration) → PI System → predictive maintenance alerts.

Integration: Often paired with Historian servers, PI Analytics, PI Vision (web dashboards). APIs for custom apps.

IT roles: PI System administrator, PI developer, PI security engineer, Historian specialist.

Career path: Sysadmin or database admin → PI specialist (3–6 month ramp) → AVEVA Solution Architect (6–18 months). Salary: $95k–$160k depending on experience & location.

Citation: AVEVA PI System Overview

Emerson DeltaV, Honeywell PlantWeb, GE DigitalSCADA

• Emerson DeltaV: Distributed control system (DCS) for process industries (oil refining, chemical). Safety instrumented systems (SIS) module. $80k–$130k engineer.
• Honeywell PlantWeb: Process management ecosystem; DCS, HMI, asset monitoring. Integrated with OPC UA.
• GE DigitalSCADA / Siemens SCADA: Transmission/distribution utilities; real-time state estimation, optimal power flow (OPF).

All require domain experience (refining, power gen, etc.) + OT fundamentals. Vendor certifications exist but internal training dominates.

4.2 Enterprise Resource Planning (ERP) for Utilities

SAP IS-Utilities

Purpose: Integrated financial/operational system for utilities (electric, gas, water). Combines billing, asset management, maintenance scheduling, regulatory reporting.

Modules:

• Billing & customer data management (CDM)
• Asset & network management
• Work management & field service
• Regulatory reporting (NERC, EPA, FERC)

IT footprint: Large deployment (1k–5k users); integration with legacy SCADA via middleware; high availability (99.9%+ SLA).

Roles: SAP BASIS administrator, SAP HANA database engineer, SAP Utilities consultant, Integration architect.

Salary: $100k–$160k (BASIS); $110k–$180k (HANA).

Citation: SAP Industry Solutions for Utilities

Oracle Utilities, IBM Maximo

• Oracle Utilities: Head-to-head with SAP; common in North American utilities. Includes Meter Data Management (MDM), OMS (Outage Management System), DMS (Distribution Management System).
• IBM Maximo (Asset Management Suite): Maintenance, asset lifecycle, predictive analytics (AI-driven). Increasingly deployed for grid modernization. Features smart meter lifecycle, renewable asset integration.

IBM Maximo example: A 500-MW wind farm uses Maximo to track 5,000+ component lifecycles, predict bearing failures 6 months in advance, optimize spare parts inventory. Reduction in unplanned downtime: 25–40%.

Citation: IBM Maximo for Utilities; Oracle Utilities Solutions

4.3 Smart Grid & Advanced Metering Infrastructure (AMI)

AMI (Advanced Metering Infrastructure) Players

Market: ~135M smart meters deployed in North America (2025). Growth ~8–10%/yr.

IT roles: Meter data management (MDM) engineer, demand response specialist, grid edge architect, cybersecurity engineer (meter networks are OT attack surface).

Salary: $85k–$130k (regional variation significant).

Citation: Landis+Gyr Multi-Commodity AMI; Itron Solutions

4.4 Energy Trading & Risk Management (ETRM)

Utilities and energy companies trade power, natural gas, renewables credits in spot/forward/futures markets. ETRM software manages deal capture, hedging, risk analytics, compliance reporting.

Market Leaders

Note: ION Group (formerly ION Trading) now owns 3 of top 5 ETRM platforms, consolidating market.

ETRM market projection: USD 37B (2024) → USD 57B (2032), CAGR 5.5%.

IT careers: ETRM systems engineer, trade data engineer, compliance reporting engineer, risk analytics developer.

Salary: $100k–$170k (competitive with finance IT).

Citation: ION Allegro ETRM; ETRM Market Analysis

5. Oil & Gas Specific Platforms

5.1 Upstream, Midstream, Downstream Systems

Upstream (exploration, drilling, production):

• Schlumberger Petrel: Seismic interpretation, reservoir modeling, well planning.
• Halliburton Landmark: Well completion, hydraulics, field optimization.
• Baker Hughes Software Suite: Digital transformation, asset performance management.

Midstream (transmission, storage):

• Honeywell UniSim Design: Process simulation, pipeline design.
• Enerflex SCADA: Pipeline monitoring, compressor station control.

Downstream (refining, distribution):

• AspenTech AspenPlus: Refinery optimization, crude assay management.
• AVEVA PI: Real-time analytics across entire refinery.

IT footprint: Oil/gas IT is hybrid IT/OT. Large deployments (5k+ users) in E&P centers; high availability; strong security. Integration between surface operations, remote wells (via satellite), SCADA, and corporate ERP is standard.

Career path: IT ops → OT systems engineer → Upstream/midstream specialist. Salary +20% vs IT generalist (oil majors pay premium for domain knowledge).

Citation: SLB Petrel Subsurface Software; AVEVA PI in Oil & Gas

6. Renewable Energy & Grid Integration

6.1 NERC PRC Standards for Renewables

Wind, solar, battery storage are inverter-based resources (IBRs). Grid interconnection requires compliance with NERC Performance Requirements Committee (PRC) standards:

Category 2 deadline (smaller renewable plants): May 15, 2026 for PRC-029/030 compliance.

IT roles: SCADA engineer (wind/solar), grid synchronization engineer, synchrophasor (PMU) systems engineer, renewable compliance specialist.

Career growth: Renewable energy is fastest-growing energy sector. Expect 10-year career windows in renewables IT before consolidation.

Citation: NERC PRC Standards; Understanding NERC PRC-029/030

6.2 Smart Grid, Microgrids, VPP (Virtual Power Plants)

Smart Grid = grid sensors + controls + communication → real-time optimization. Examples:

• Demand response (shaving peak load via smart thermostats, EV charging coordination).
• Distributed Energy Resource Management Systems (DERMS): aggregating 10,000s of rooftop solar + batteries → dispatchable asset.
• Advanced Distribution Management Systems (ADMS): distribution-level state estimation, fault location, restoration automation.

IT architecture: IoT (sensors) → Edge compute (gateways) → Cloud (analytics/control) + on-prem (legacy SCADA).

Career: Smart grid architect, DERMS engineer, grid modernization program manager.

2026 context: EV charging infrastructure cybersecurity, climate-driven peak shifting, grid resilience against extreme weather = growth areas.

7. Water Utilities IT

7.1 SCADA, Treatment, Distribution

Water utilities manage:

• Treatment plants (chemical injection, filtration, testing).
• Distribution networks (1k+ miles of pipe, 1k+ nodes; leakage detection).
• SCADA for pump control, pressure regulation, tank levels.

Legacy landscape: Many water systems run 20–40-year-old SCADA (Wonderware, FactoryTalk, older Modbus). Cybersecurity has been neglected (See EPA § 1433 findings: 70% non-compliant).

Modernization drivers:

• EPA SDWA § 1433 enforcement (2024 onwards).
• Infrastructure investment (federal grants; IIJA infrastructure bill).
• Cyber-physical incidents (Muleshoe, Texas 2024 SCADA breach).

IT roles: Water SCADA engineer, cybersecurity analyst (water), network engineer (utility networks), distribution optimization specialist.

Salary: $75k–$125k (40% below oil/gas equivalent, but growing 8–12%/yr due to demand surge).

Citation: EPA SDWA § 1433 Enforcement Alert (2024); Water Sector Cybersecurity Guidance

8. Mining IT

Mining IT spans operational automation, safety, production optimization.

8.1 Market Players (2025)

2025 market: Digital mine solutions = $12.4B; projected $28.9B by 2034 (CAGR 9.8%).

South African context: Major gold/platinum mines (Anglo American, Impala Platinum, Sibanye-Stillwater) actively deploy autonomous fleets & AI-driven safety; Hexagon & Modular dominate South African gold operations.

8.2 Typical Mining IT Stack

• Production management: Pit optimization (Hexagon), mine planning (Maptek Vulcan, Carlson).
• Haulage/fleet: Autonomous vehicle control (Caterpillar FrontRunner, Komatsu Autonomous), telematics.
• Safety/compliance: Real-time personnel tracking, air quality sensors, blast monitoring.
• Energy: Mine power management (compressors, crushers), renewable integration (solar at remote sites).

IT roles: Mining operations engineer, safety systems engineer, autonomous fleet engineer, mine data analyst, predictive maintenance engineer.

Salary: $85k–$140k (highly dependent on location; Australia/South Africa mines pay USD-equivalent premiums).

Citation: Hexagon Mining Solutions; Caterpillar MineStar; Digital Mine Market Forecast

9. Career Paths & Specializations

9.1 Traditional Energy/Utilities Career Arc

Tier 1 (Entry)
├─ IT Help Desk → Utility IT Support Specialist ($50–60k)
├─ Junior Network Admin → Utility Network Engineer ($60–75k)
└─ Junior Systems Admin → Utility Systems Engineer ($60–75k)

Tier 2 (Mid)
├─ SCADA Operator (control room) → SCADA Engineer ($75–100k)
├─ Network Engineer → Senior Network Engineer / Grid Architect ($90–130k)
├─ Utility Systems Eng → Systems Architect / Compliance Engineer ($85–120k)
└─ [NEW TIER 2.5: ICS/OT Security]
    └─ Junior Cybersecurity Analyst → ICS/OT Security Engineer ($85–120k)

Tier 3 (Senior / Principal)
├─ SCADA Engineer → Principal SCADA Architect ($110–160k)
├─ ICS/OT Security Eng → Senior ICS Security Architect / NERC CIP Manager ($120–170k)
├─ Network Architect → Chief Network Architect ($130–190k)
└─ Systems Architect → Enterprise Architect / Chief Technology Officer ($140–250k+)

9.2 Specialization Options

A. NERC CIP Compliance Path

IT Generalist → NERC CIP Compliance Analyst ($70–90k)
                ↓ (GIAC GCIP cert + 2–3 yrs experience)
NERC CIP Specialist ($90–130k)
                ↓ (5+ yrs NERC env)
NERC CIP Manager / Senior Specialist ($130–170k)
                ↓
Director of Compliance / Chief Compliance Officer ($160–230k+)

B. ICS/OT Security Path

IT Security Analyst → ICS/OT Security Engineer (GICSP/GRID cert + hands-on labs)
                      ↓ ($80–120k initial)
Senior ICS Security Engineer (5+ yrs, incident response experience)
                      ↓ ($120–160k)
ICS Security Architect / Principal ($140–200k)

C. Smart Grid / AMI Path

IT Ops → Meter Data Management (MDM) Engineer ($75–100k)
         ↓ (2–3 yrs)
Senior MDM / Demand Response Specialist ($100–140k)
         ↓
Smart Grid Architect / Program Manager ($120–180k)

D. Trading & Risk Path (high pay, specialized)

Finance IT / Java Developer → ETRM Systems Engineer ($100–150k)
                             ↓
ETRM Solutions Architect / Lead ($140–220k)
                             ↓
Director of Trading Systems ($180–350k+)

9.3 Entry Routes for Career Changers

• Electrical engineer / Power systems → Utility SCADA engineer: 6–12 months transition; salary often increases 20–30%.
• IT generalist + GIAC GICSP cert → ICS/OT security: 12–18 months of lab work + industry placement.
• Database admin (Oracle/SAP) → Utility ERP specialist: Natural transition; 2–6 months domain onboarding.
• Finance IT / trading systems → ETRM engineer: 1–2 years (requires commodity/trading knowledge).

9.4 Salary Benchmarks (US, April 2026)

Per Robert Half 2026 Salary Guide:

Premium adjustments:

• Geography: Tight labor markets (CA, TX, NE corridor) +10–20%.
• Specialization: ICS/OT security, NERC CIP, trading systems: +15–30% vs IT generalist.
• Industry: Oil/gas majors pay +20% over utilities; utilities pay +10% over municipal IT.
• Remote: Limited remote availability; on-site presence often required (control room, substation visits).

10. Training & Certifications

10.1 SANS ICS Courses (2025–2026)

All instructor-led (live virtual or in-person); each comes with GIAC certification exam.

2026 event: SANS ICS Security Summit & Training 2026 (dates TBA; typically Feb–March).

Citation: SANS ICS Courses

10.2 Free Resources

• NERC Reliability Standards: Free PDF downloads from NERC.com.
• NIST SP 800-82 Rev. 2: "Guide to Industrial Control Systems (ICS) Security" (free, comprehensive).
• CISA Energy Sector Resources: CISA.gov/energy (threat advisories, best practices).
• DOE Cybersecurity Training: Free webinars, case studies.
• IEEE Power & Energy Society: Webinars, published standards (pay-access).

10.3 Recommended Reading

Citation: Industrial Network Security (3rd ed) on O'Reilly; Power System SCADA and Smart Grids

11. Conferences & Communities

11.1 Major Conferences

Citation: S4x27 Events; DistribuTECH 2026; IEEE PES T&D

11.2 Online Communities & Mailing Lists

• SANS Energy Sector Mailing List (ICS-CERT updates).
• NERC Compliance Community (utility compliance officers, NERC auditors).
• ICS Community Forum (Dragos, independent researchers).
• LinkedIn Groups: "Energy Utilities IT," "SCADA Engineers," "Power Systems IT."

12. South African Context

12.1 Eskom (National Utility) & Energy Transition

Eskom Holdings SOC Ltd is Africa's largest electricity producer and South Africa's dominant utility. As of 2025:

• Coal decommissioning plan: 23 GW decommissioned by 2040; replacement via hydro, gas, nuclear, renewables.
• MOU with Exxaro (April 2025): Green hydrogen pilot facility at Johannesburg Research & Testing center.
• Renewable energy targets: By 2039, >105,000 MW new capacity (wind, solar, nuclear) via Integrated Resource Plan (2025 Parliament approval).
• IT investment: Eskom IT is undergoing major digital transformation (legacy SCADA replacement, NERC CIP-aligned standards adoption, cybersecurity hardening).

IT career opportunity in Eskom:

• SCADA modernization programs (5–10-year horizon).
• Renewable integration teams.
• Cybersecurity hiring surge (3x headcount growth 2025–2027).

Salary context (ZAR): Junior SCADA engineer: R400k–R550k/yr ($22–31k USD); Senior: R900k–R1.4M ($50–77k USD). Note: ZAR:USD = ~18:1 (April 2026); local purchasing power ~40% lower than US equivalent.

Citation: Eskom Holdings; South Africa Energy Transition Plan (2025); Eskom Hydrogen Pilot (April 2025)

12.2 Sasol (Petrochemical & Energy)

Sasol Limited is South Africa's second-largest emitter (GHG); major energy producer. 2025 developments:

• Coal transition: Running flagship plant at full capacity, offsetting coal feedstock via renewables.
• Renewable power agreements: 920 MW wind/solar PPAs signed; target 2,000 MW by FY2028.
• IT footprint: Sasol runs integrated energy production, trading, supply chain; employs 500+ IT staff across energy, IT operations, data analytics.

Career opportunity:

• Energy trading systems (ETRM).
• Supply chain analytics (SAP/Oracle integration).
• Cybersecurity (downstream operations sensitive to ransomware).

Salary: Senior IT roles at Sasol: R900k–R1.5M/yr (~$50–83k USD).

Citation: Sasol Energy Transition (May 2025)

12.3 South African Mining IT (Anglo American, Impala Platinum, Sibanye-Stillwater)

South Africa is world's largest producer of platinum, largest of gold (after China). Mining IT is a major vertical.

IT opportunities in SA mining:

• Autonomous vehicle operations (Caterpillar MineStar, Hexagon).
• Predictive maintenance (AVEVA PI, Maximo).
• Remote operations centers (managing mines from Johannesburg).
• Renewable energy for mines (solar, battery storage).

Salary: Junior mining IT engineer: R450k–R600k ($25–33k USD); Senior architect: R1M–R1.8M ($56–100k USD).

Citation: Anglo American Careers; Implats Energy Transition; Sibanye-Stillwater Investor Relations

13. 2026 Emerging Trends & Skills

13.1 AI & Predictive Maintenance in Energy/Utilities

2025–2026 trend: Energy sector aggressively deploying machine learning for predictive maintenance.

Examples:

• Transformer failure prediction (temp, fluid composition, load history → ML model predicts failure 6–12 months ahead).
• Wind turbine blade fault detection (vibration sensors → neural network identifies microfractures).
• Substation anomaly detection (time-series analytics identify protocol/equipment anomalies pre-failure).

Skills in demand:

• Python, TensorFlow, scikit-learn for energy domain.
• Time-series forecasting (ARIMA, Prophet, transformers).
• ICS/OT domain understanding (critical; many data scientists lack it).

Emerging roles: Energy AI Engineer ($110–160k), Predictive Analytics Specialist (Energy), Digital Twin Architect.

13.2 EV Charging Infrastructure Cybersecurity

As EV adoption accelerates, charging networks are new OT attack surface.

• NIST/SAE standards for EV charger security (emerging 2025–2026).
• Utilities deploying "smart charging" (V2G—vehicle-to-grid) to manage peak loads.
• Cybersecurity risk: Compromised charger network = grid load manipulation attacks.

New roles: EV Charging Infrastructure Security Engineer, Grid-Edge Resilience Specialist.

13.3 Climate-Driven Grid Resilience

Extreme weather (floods, wildfires, hurricanes) increasingly threaten grid assets.

• Microgrids & islanding: Ability to disconnect from main grid and self-serve (islanded operation).
• Distributed resilience: Renewable + battery assets at grid edge (vs centralized generation).
• IT roles: Resilience Engineer, Microgrid Control Systems Engineer, Climate Risk Analyst (for utilities).

13.4 NERC CIP-013 Supply Chain & Software Transparency

CIP-013-3 (2025) escalating vendor oversight.

• Software Bill of Materials (SBOM) required for critical ICS software.
• Third-party risk assessment (vendor security posture audits).
• IT roles expanding: Supply Chain Risk Manager (Energy), Vendor Security Engineer, SBOM Analyst.

14. Competitive Salary Comparison (2026)

Energy/utilities IT commands a premium over generalist IT, driven by:

• Regulatory compliance risk.
• Domain specialization barrier.
• Critical infrastructure classification (national security importance).

Regional variation (US):

• California (coastal utilities, renewable hubs): +15–20% over national average.
• Texas (Lone Star Grid, ERCOT, major oil/gas): +12–18%.
• Northeast (PJM, ConEd, legacy utilities): +8–12%.
• Midwest (Midwest ISO, lower COL): -5–10%.

15. Learning Outcomes & Action Plan

For IT Generalists Considering Energy/Utilities

1. Foundation (3–6 months):

   • NIST SP 800-82 (free read; 50 pages).
   • SANS ICS410 course (6 days; $8–10k) → GICSP cert.
   • Set up home lab (Siemens S7-1200 PLC, OpenPLC, virtual HMI).

2. Specialization (6–12 months):

   • SANS ICS456 (NERC CIP focus) → GCIP cert.
   • Apply for SCADA operator or junior cybersecurity role in utility.
   • Join IEEE PES, NERC compliance communities.

3. Mastery (2–3 years):

   • Lead compliance audit or incident response.
   • Obtain vendor-specific certs (Siemens, Rockwell, GE).
   • Consider Master's in Power Systems (part-time) if pursuing architecture track.

For ICS/OT Professionals Pivoting to Energy

1. Domain onboarding: Read "Power System SCADA and Smart Grids" book; understand grid architecture, relay protection, load flow.
2. Certification: SANS ICS456 → GCIP (positions for compliance role).
3. Network: Attend DistribuTECH, IEEE PES T&D; connect with utility CIOs, NERC auditors.
4. Target role: NERC CIP Compliance Specialist (bridge role) or Senior ICS Security Architect.

Sources

NERC CIP Standards — Official Index

NERC CIP Roadmap 2026

FERC Order No. 907 — CIP-015-1 Approval (June 2025)

Federal Register — Potential CIP Enhancements (2025)

Federal Register — CIP-003-11 Proposed (2025)

TSA Press Release — Pipeline Cyber Updates (July 2024)

GAO-25-107947 — Pipeline Cybersecurity Analysis (2025)

EPA SDWA § 1433 Cybersecurity Guidance (2024)

EPA Enforcement Alert — Drinking Water Cybersecurity (March 2024)

CISA Water & Wastewater Sector Resources

GIAC GICSP Certification

GIAC GRID Certification

SANS ICS410 — ICS/SCADA Security Essentials

SANS ICS456 — NERC CIP Essentials

SANS ICS Security Courses Overview

NIST SP 800-82 Rev. 2 — Guide to ICS Security

Landis+Gyr Multi-Commodity AMI Solutions

Itron Smart Grid Solutions

ION Group — Allegro ETRM

ETRM Software Market Analysis

AVEVA PI System Overview

IBM Maximo for Utilities & Energy

Oracle Utilities Solutions

NERC PRC Standards — Performance Requirements Committee

Understanding NERC PRC-029-1 & PRC-030-1 — IBR Standards

Hexagon Mining Solutions

Caterpillar MineStar Solutions

Digital Mine Solution Market Forecast (2025–2034)

Robert Half 2026 Technology Salary Guide

S4x Events — ICS Security Summit

DistribuTECH 2026 Conference

IEEE Power & Energy Society T&D Conference

Eskom Holdings — Official Site

South Africa Energy Market Report & Transition Plan (2025)

Sasol Limited — Energy Transition Initiatives (2025)

Industrial Network Security: Securing Critical Infrastructure Networks (3rd Ed, 2024)

Knapp & Langill — Industrial Network Security on Amazon

16. Certifications — Quick Reference Table

17. Free Training Resources

• NERC CIP standards (free PDF): NERC CIP Standards Index
• CISA ICS Virtual Learning Portal (free, web-based): CISA ICS Training
• CISA ICS Training Calendar: ICS Training Calendar
• NIST SP 800-82 Rev. 2 (free PDF): NIST Guide to ICS Security
• AVEVA PI Square Community (free forums + resources): PI Square - AVEVA Community
• AVEVA PI System Training (instructor-led + virtual): AVEVA Training Support
• Robert M. Lee's ICS/SCADA Resources: Robert M. Lee — ICS Resources
• YouTube: ICS Cybersecurity Hub & SCADA Security (real URLs): Robert M. Lee YouTube talks; Threat Hunting talks
• FERC documents & orders: Federal Register CIP Orders

18. Paid Course Platforms

SANS:

• SANS ICS410 — ICS/SCADA Security Essentials (~$8–10k)
• SANS ICS456 — NERC CIP Essentials (~$7–9k)

Udemy:

• ICS/SCADA Cyber Security
• ICS Cybersecurity: SCADA, PLC, DCS & IEC 62443
• OT Security: ICS & SCADA, Purdue Model, MITRE ICS, & Pentest
• Fundamentals of OT Cybersecurity (ICS/SCADA)

Other platforms:

• Coursera: Search "ICS cybersecurity," "SCADA," "industrial control systems"
• Pluralsight: ICS/OT security paths
• Cybrary: SCADA & ICS training library

19. Books — Essential Reading

20. Typical IT Job Titles (Energy/Utilities Sector)

• SCADA Engineer / SCADA Systems Engineer
• ICS/OT Security Engineer
• Smart Grid Engineer / Smart Grid Architect
• AVEVA PI System Administrator / PI Developer
• NERC CIP Compliance Analyst / Compliance Specialist
• Utilities Cybersecurity Analyst / Senior Cybersecurity Engineer
• Substation Automation Engineer
• Distribution Network Engineer
• ETRM Analyst / ETRM Systems Engineer
• Mining Operations Engineer / Autonomous Fleet Engineer
• Grid Modernization Program Manager
• Utility IT Director / VP Technology

21. Common Hard & Soft Skills

Hard Skills:

• DNP3, Modbus, IEC 60870, IEC 61850, OPC UA protocols
• Purdue Enterprise Reference Architecture (PERA) model
• SCADA/HMI platform operation & configuration
• AVEVA PI System (historian, analytics, vision)
• NERC CIP-002 through CIP-015 standards
• Firewall & network segmentation (Cisco, Fortinet, Rockwell)
• Vulnerability scanning, patch management, EDR
• ICS forensics & incident response
• SAP IS-Utilities / Oracle Utilities integration
• Python, SQL for time-series analytics

Soft Skills:

• Cross-functional coordination (Safety, OT, IT, regulatory)
• Change management in regulated environments
• On-call / shift work (control room presence)
• Presentation skills for compliance audits
• Technical documentation (BCSI handling)
• Root cause analysis (RCA) for post-mortems

22. Salary Data (Cited Sources)

United States (USD) — April 2026

Per Robert Half 2026 Salary Guide:

South Africa (ZAR / USD equiv.) — April 2026

Per PayScale SCADA Salary South Africa:

Note: ZAR/USD rate fluctuates (historically 16–20:1). Local purchasing power ~40% lower than US nominal equivalents. South African utilities (Eskom, Sasol) and mining companies (Anglo American, Impala Platinum) offer significant premiums for skilled OT/ICS staff.

Citation: PayScale SCADA Salary ZA; Robert Half 2026 Salary Guide