Job Description
In search of a resident expert on SigmaFlow compliance workflow management and NERC CIP requirement traceability for a utility sector consulting engagement.
The work answers a single executive question: should an established SigmaFlow implementation carry a NERC CIP compliance program forward through a platform upgrade, or through a ground-up rebuild of its workflow implementation? Leadership needs that answer supported by evidence, not opinion. You will produce the analysis, the testing, and the documentation that gets them there and then help execute whichever path is chosen.
This is hands-on analytical work. You will be inside the platform, inside the standards, and in front of the people who run both. The contractor in this role has the deepest SigmaFlow and NERC CIP knowledge on the team, and is expected to operate with minimal oversight.
Requirement Mapping
- Trace each compliance workflow and each step within it to the specific NERC CIP standard and requirement it satisfies, establishing a defensible chain from requirement to policy to procedure to workflow.
Coverage Matrix
- Build and maintain a requirement coverage matrix spanning CIP-002 through CIP-014 with concentration in CIP-004, CIP-007, CIP-010 and CIP-011.
Gap and Engineering Analysis
- Identify requirements with no supporting workflows, and workflow steps with no traceable mandate. Recommend workflow designs anchored to what the standards actually require rather than to what the tool happens to do or what is considered least effort.
Evidence Chain Validation
- Confirm that each workflow produces the artifacts an auditor will ask for and in a form that s appropriate for an audit.
Information Protection
- Apply CIP-011 BCSI handling obligations to non-production environments, test data strategy, and documentation storage. SigmaFlow Platform Analysis and Upgrade Validation
Current State Architecture Documentation
- Capture platform version and components, workflow logic, SQL datasets and conditional routing, reporting, role and permission model, authentication architecture, integrations, and data retention states.
Test and Baseline Validation
- Verify a non-production test environment against a production baseline including workflow counts accounts, role assignments, configuration, schema, data integrity and attachments.
Defect Triage and Root Cause Analysis
- Categorize failures across deprecated activities, API and database schema changes, permission model changes, custom code incompatibility, integration endpoint changes, unsupported customizations and configuration drift.
Access Governance Testing
- Test role permission boundaries for privilege escalation and access gaps, and validate separation-of-duties patterns for administrative accounts.
Remediation Sequencing
- Estimate design, build, test and validation effort per workflow; prioritize a remediation backlog; contribute the cost, risk and benefit comparison behind the overall upgrade plan.
Knowledge Capture and Documentation
- Run structured interviews to recover undocumented workflow intent, triggering events, edge cases and historical failure modes before that knowledge is unavailable. Much of what this platform does exists only in people's heads.
Procedure Authoring
- Write standard operating procedures, administrative procedures, architecture reference guides, playbooks, and cutover runbooks with defined rollback triggers to a client document template.
Compliance Continuity Planning
- Document how compliance obligations are met during any platform outage window. The production platform cannot go dark.
Teach back
- Transfer working knowledge to client staff and client delivery team through documented sessions. Success means the client is less dependent on any single person.