Kenneth (Kc) Carnes Email and Phone Number

TVA's mission around Energy, the Environment and Economic Development remains clear and focused. Our security focus at TVA is the same. We strive to design best in class protections and detection capabilities via architecture and human ingenuity. In this role I also occupy the Chief Artificial Intelligence Officer role to enable the safe and secure use of AI to enable our business.

Security like safety is in our organizational DNA. Leading an amazing group to future proof and improve our resilience and overall capability to protect critical operations. We strive to design best in class protections and detection capabilities via architecture and human ingenuity. Turning our focus from the noise, towards the most impactful areas, looking with a lens to the future and driving consequence informed design as our basis of cyber protection. TVA is a leader in cybersecurity and all aspects of utility security as it relates to safe and reliable operation.

At NYPA, we like to be trailblazers. With my most recent role, we are doing again. I have combined my background in operational technology, networking, IT Infrastructure & cyber security into a cohesive operational and risk management role to ensure critical services to the business that are secure and resilient in all scenarios. As we continue our journey towards a digital utility we will continue to clearly define technology strategy and investments to drive business value. My team achieves this goal by focusing on holistic standards with a base priority of enabling the business securely. We can readily identify cyber risk and threats in our environment with our integrated capabilities in our Integrated Smart Operations Center. This allows us to focus on higher level capabilities with our staff and for our customers.

As the cyber security leader in critical infrastructure, I am required to grasp business strategy and align our security posture and compliance. Working with our lines of business and technology stakeholders, I effectively improve our cyber maturity and program reach. Experienced with transforming security culture, by building relationships and placing security second only to safety. I work tirelessly to foster and build strong relationships internally and externally to help achieve our goals. With my team we implemented innovative methods focused on processes and risk to protect our environment, while aligning with business strategy. I coordinate cyber incident response alignment across the organization to share information and drive expedient cultural response to cyber events. By always looking up and out with a focus on global, industry and organizational threats, we are able to implement actionable mitigation. Cyber security is so much more than the technology and I understand how to coach and develop others to see and comprehend methods and techniques to ensure cyber resilience of any system. I manage our organizational cyber risk and partner with all lines of the business to "Enable the business securely". I am active in various external organizations like InfraGard, EPRI (Electric Power Research Institute), LPPC (Large Public Power Council) and ESCC (Electric Subsector Coordinating Council). I have experience leveraging various frameworks and models in order to define and develop tailored programs with tracking and metrics that articulate the posture of our program to senior leaders.

During my tenure in this role, I was involved in various organizational governance committees from corporate security oversight, operational networks (IT/OT), electric reliability and enterprise risk management. I partnered with the business to integrate security controls and protections through out business processes. I leveraged industry standards and compliance requirements to ensure nuclear site and corporate program security. As the cyber security leader for this vertically integrated electric utility, I focused on business strategy and aligned the security program to deliver. In overseeing the deployment of our enterprise technologies, polices and standards. I made OPPD more agile and capable to understand, respond, and if needed, recover to cyber threats and risks.

Coaches and mentors make such a remarkable difference, and I was personally blessed to experience that impact during my time in this role. Initially, I was the typical engineer with big ideas and limited business understanding to get them completed or in some cases started. Consistent coaching and development from a superb mentor, allowed me to leave this role as the lead data center architect, responsible for all disaster recovery, enterprise systems architecture and storage area networks. As the technical lead we deployed our first virtualization environments and I was a project manager for various data center projects. Developed roadmaps and budgets in order to complete business cases and later successfully would deliver on requirements, function and knowledge transfer. During historic flooding at our nuclear station, I was stress tested during real life recovery and response incidents. Events like the flooding and other real disasters have helped to hone my skills to respond with a clear and determined focus on outcomes.

This was a transitional role while integrating our Nuclear Business unit into corporate Information Technology. In this role, I functioned as a business analyst to help the business transfer nuclear processes and systems. I developed interfaces to national databases which required me to understand nuclear security processing requirements, training and dosimetry processes to ensure all hires completed all the proper training and forms before granting them a site security badge to our nuclear facility. I also transitioned in-core monitor system GARDEL and the nuclear engineer computer codes testing and installation processes to other individuals.

I supported reactor engineering and plant DCS systems with code installation, testing and development of various scripts for transient situations. I was responsible to develop and automate processes, document and perform knowledge transfer. I designed and supported the station CBT program and nuclear security training. I was able to support site physical security acting as an adversarial controller during NRC graded force-on-force exercises. I designed and developed a custom enterprise application to integrate site on-boarding processes of training, dosimetry and security badging to track and ensure all requirement completions for badging while completing our steam generator replacement project.

INFO1400 Hardware, Disaster Recovery and TroubleshootingINFO1401 Introduction to Data Center ManagementINFO1421 Virtualization, Remote Access and Monitoring

In this throw them in, sink or swim environment, I developed and designed software solutions for hardware automation from the HMI to the PLC. Developing in this FDA regulated environment, I was well trained in software development lifecycle and software testing methods.

I mainly developed CBT and supported nuclear training, the reason I include it here is during my time at Cooper, I proctored all annual re-qualification training and hence, I had to complete all nuclear CBT programs (Operations, QA, Radiation Protection, etc). I worked with the simulator staff and I developed reactor water cleanup CBT using DDE memory reads of the simulator software.