Sr. Lead, Cybersecurity Risk · Citgo Petroleum

Emanuel
Lopez

Cyber Risk Quantification · IT/OT Risk Programs · Industrial Control Systems

8+ years securing critical infrastructure at enterprise scale — now leading cybersecurity risk across IT and OT at a major refiner, translating SCADA-level technical exposure into business impact executives can act on.

View Experience → Get in Touch
8+
Years in ICS/OT Security
500+
Systems Hardened
70%
Cost Efficiency Achieved
Emanuel Lopez

// Background

About Me

I'm a cybersecurity risk leader with deep specialization in Operational Technology (OT), SCADA, and Industrial Control System (ICS) environments. My career has been built at the intersection of engineering and security — where protecting critical infrastructure demands both technical depth and strategic thinking.

Today I lead cybersecurity risk at Citgo Petroleum, running risk assessments across IT and OT estates, driving vulnerability management, and using FAIR-based quantification to put a dollar figure on exposure so leadership can prioritize with real numbers instead of heat maps.

Before that, I spent 8 years at Chevron progressing from vulnerability analyst to program leadership, designing and deploying security solutions that protected some of the most critical systems in the energy sector. I bridge the gap between engineering teams and executive leadership, translating technical risk into business decisions.

Bilingual (English/Spanish), and equally comfortable in a field deployment or a boardroom briefing.

Location Houston, TX
Focus Cyber Risk · IT/OT · NIST · FAIR
Frameworks NIST RMF · 800-53 · 800-161 · CSF 2.0 · FAIR
Education BBA, Cybersecurity & Information Systems — UTSA
Languages English · Spanish
Current Sr. Lead, Cybersecurity Risk — Citgo Petroleum

// Expertise

Skills & Capabilities

⚖️
Cyber Risk Management

Run enterprise risk assessments across IT and OT estates under the NIST RMF, quantify exposure with FAIR, and report risk posture to stakeholders through KPIs and dashboards.

FAIR NIST RMF (800-37) NIST 800-53 NIST 800-161 C-SCRM NIST CSF 2.0 Third-Party Risk KPI Reporting
🏭
ICS/OT Security

Deep hands-on experience securing SCADA, HMI, PLC, and process control networks in energy sector environments.

SCADA PLC HMI PCN ESXi
📋
Compliance & Governance

Built NIST- and CIS-aligned compliance programs from the ground up, driving audits, control evidence, and risk remediation at enterprise scale.

NIST 800-82 (OT) NIST 800-171 ISO 27001 CIS Controls GRC Audit Support PCI DSS
🔍
Threat Intelligence & Hunting

Researched and tracked threat actor groups, produced executive intelligence products, and led proactive threat hunting on corporate infrastructure.

CrowdStrike IoC Analysis Threat Hunting Splunk
🛡️
Vulnerability Management

Executed pen tests, full attack chain demonstrations, and remediated critical vulnerabilities across 500+ systems and multiple business units.

Nessus Tenable HP Fortify Pen Testing
☁️
Cloud & Data Security

Led enterprise AIP deployments and elevated DLP capabilities using hash matching, document fingerprinting, and custom regex markers.

Azure AIP DLP Azure DevOps Power BI
📊
Program & Project Management

Managed full project lifecycles, cross-functional teams, and national-scale deployment programs across critical infrastructure sites.

Agile PMP (In Progress) UiPath Power Automate

// Career History

Professional Experience

Sr. Lead, Cybersecurity Risk Jul 2026 – Present
Citgo Petroleum · Houston, TX
  • Lead cybersecurity risk assessments across IT and OT environments — networks, cloud platforms, IoT, data centers, and applications — applying the NIST Risk Management Framework (SP 800-37) and the SP 800-53 Rev. 5 control catalog.
  • Own third-party and supply chain risk using NIST SP 800-161 (C-SCRM), assessing vendor exposure across the product and service lifecycle and mapping findings back to enterprise control gaps.
  • Direct vulnerability management end to end: scanning, penetration testing, threat modeling, and patch prioritization in partnership with engineering and operations teams.
  • Quantify and communicate risk using FAIR, translating technical exposure into business impact for executive stakeholders and governance forums.
  • Support incident response and post-incident root cause analysis, and track program KPIs and dashboards to measure risk reduction over time.
PSA Systems Administrator Sep 2025 – Jul 2026
ITSourcePro (Managed Service Provider) · Houston, TX
  • Administered the Halo PSA platform for a growing MSP, owning workflow configuration, ticket lifecycle rules, and billing accuracy across the full client base.
  • Authored the company's standardized billing and workflow documentation set — including a multi-tab ticket-close procedure workbook that turned tribal knowledge into a repeatable process for the service desk.
  • Built a consolidated customer contract reference chart, giving technicians and account managers a single source of truth for entitlements and billable scope.
  • Identified automation and integration opportunities across the service delivery stack, scoping workflow automation to cut manual handling on recurring ticket types.
ICS Hardening & Compliance Engineer Feb 2024 – Aug 2025
Chevron · Houston, TX
  • Managed full project lifecycle for automated ESXi security scanning across Critical and High-Risk Infrastructure Sites, from planning through final deployment.
  • Served as National SME directing cross-country SCADA implementation programs, including phased deployments of auto scanning, secure file transfer, and Splunk logging.
  • Governed adoption of new security tools across engineering, operations, and IT stakeholders for all SCADA-related projects.
ICS IT/OT Systems Analyst Jan 2022 – Feb 2024
Chevron · Greenley, CO
  • Built foundational inventory, architecture, and process controls from scratch to meet all NIST compliance and audit requirements.
  • Directed security safeguards, risk assessments, and threat indicator monitoring — significantly reducing attack surface across field and process control network environments.
  • Deployed ruggedized OT field systems (HMI, PLC, Microwaves, Radios, Routers, Switches) into remote production environments.
Cyber Security Defense Engineer Feb 2020 – Jan 2022
Chevron · Houston, TX
  • Executed pen tests against GRC and productivity apps (Archer, ServiceNow) and Office Message Encryption to identify and mitigate critical authentication risks.
  • Led enterprise-wide deployment of the Azure Information Protection (AIP) client, serving as SME for business acceptance, packaging, and change management.
  • Expanded DLP capabilities to endpoint devices using hash matching, document fingerprinting, and custom regex markers.
Cyber Threat Intelligence Analyst May 2019 – Feb 2020
Chevron · Houston, TX
  • Tracked sophisticated threat actor groups via CrowdStrike and other platforms; published intelligence products on cybercrime risk to executive leadership.
  • Led proactive enterprise threat hunting on corporate firewalls and email logs, rapidly neutralizing IoCs tied to malware and ransomware campaigns.
  • Developed tailored intelligence products for security teams and business stakeholders to enhance organizational defense posture.
Industrial Control System Vulnerability Analyst May 2018 – May 2019
Chevron · Houston, TX
  • Pioneered a critical SCADA security redundancy solution achieving 70% cost efficiency vs. existing alternatives — deployed enterprise-wide.
  • Redesigned complex Process Control Network schemas within a 2-month turnaround.
  • Managed vendor acquisition and procurement for hundreds of OT units across hundreds of facilities.
Cybersecurity Vulnerability Analyst May 2017 – May 2018
Chevron · Houston, TX
  • Authored and presented a full proof-of-concept attack chain — from employee terminal compromise to industrial SCADA console access — exposing a high-risk security gap.
  • Documented the complete kill chain including vulnerability leveraging, credential elevation, ICS data manipulation, and persistence techniques.
  • Remediated the highest critical vulnerabilities across 500+ systems spanning multiple business units.

// Credentials

Education & Certifications

🎓
BBA — Cybersecurity
University of Texas at San Antonio
🎓
BBA — Information Systems
University of Texas at San Antonio
🔒
Certified Vulnerability Scanning Tools
Certified
🔒
Certified Nessus
Certified
🔒
Certified HP Fortify & Tenable
Certified
📌
Project Management Professional (PMP)
In Progress

// Let's Connect

Get in Touch

Always glad to talk shop with people working on ICS/OT security, cyber risk quantification, and critical infrastructure defense.

✉️ Send Email LinkedIn →