Director, Enterprise Security

We are looking for talented individuals who are passionate about making an impact in the company and the community. Apply now and become part of the dynamic energy industry!

Position Description

The Director of Enterprise Security is the senior-most authority responsible for the organizations enterprise security posture. This role provides strategic leadership governance and execution across Cybersecurity (IT and OT) Physical Security Identity & Access Management and Enterprise Compliance in a highly regulated utility environment.

This role is a key member of the IT Leadership Team serving as a strategic partner to the CIO and a peer to other senior IT leaders. The Director collaborates in establishing and executing the enterprise IT vision strategy architecture and investment priorities ensuring security is embedded into all technology decisions and initiatives. As a member of the IT Leadership Team this role shares accountability for delivering secure reliable resilient and compliant technology capabilities aligned with company strategy and operational priorities.

The Director defines and executes a comprehensive enterprise security strategy that protects critical infrastructure ensures regulatory compliance enables a CloudFirst operating model and maintains customer regulator and stakeholder trust. The role partners closely with executive leadership operational organizations and business stakeholders to balance security reliability safety cost and innovation ensuring that security investments are risk-informed financially responsible and clearly tied to business value regulatory obligations operational resilience and measurable risk reduction.

Key Responsibilities

Enterprise Security Leadership & Strategy

• Serve as the enterprise leader accountable for all security domains including IT cybersecurity OT cybersecurity physical security identity and access management and compliance.
• Define maintain and execute a multiyear Enterprise Security Strategy and roadmap aligned with company strategy IT strategy regulatory requirements and operational priorities.
• Establish enterprise security governance metrics and executive reporting including risk posture maturity indicators and investment effectiveness.
• Act as the primary security and risk advisor to the CIO and executive leadership. As appropriate develop and present materials to these stakeholders in support of the security function.
• Partner with Enterprise Risk Management to identify quantify communicate and monitor enterprise security risks.

IT Leadership & Enterprise Technology Strategy

• Serve as an active peer-level member of the IT Leadership Team contributing to enterprise IT strategy operating model and transformation roadmap.
• Partner with senior IT leaders across infrastructure applications data architecture and operations to advance secure-by-design practices with clear exception risk acceptance and prioritization processes.
• Partner with senior leaders across the organization to amplify and achieve security goals.
• Influence enterprise technology investment and architectural decisions through riskinformed guidance that balances security reliability cost and business value.
• Participate as a decisionmaker in IT governance forums architecture review and strategic planning processes.
• Ensure security strategy and capabilities are tightly integrated with IT modernization initiatives.
• Prepare and deliver clear business-oriented security updates for executive board audit regulatory and governance forums as needed.

CloudFirst Security Enablement

• Lead the design and implementation of security capabilities that enable and scale a CloudFirst enterprise architecture.
• Establish cloud security standards reference architectures and guardrails including:
  • Secure cloud landing zones
  • Cloud security posture management (CSPM)
  • Cloud workload container and API security
  • Data protection and encryption strategies
• Embed security into application delivery through DevSecOps secure SDLC practices.
• Govern thirdparty and cloud service provider risk through standardized assessments and monitoring.

Operational Technology (OT) Cybersecurity Maturity

• Provide leadership for OT cybersecurity across generation transmission distribution and field operations.
• Partner with Operations Engineering and Reliability teams to advance OT cyber maturity while preserving safety and system reliability.
• Establish OT cybersecurity governance covering:
  • Asset visibility and classification
  • Network segmentation and secure remote access
  • Vendor and contractor access controls
  • OTappropriate vulnerability and patch management
• Develop test and maintain OTspecific incident response plans and conduct exercises.

IT Cybersecurity Maturity & Resilience

• Maintain and continuously improve enterprise IT cybersecurity maturity including:
  • Security operations (SOC) monitoring and SIEM/SOAR
  • Vulnerability management and configuration compliance
  • Endpoint network and email security
  • Data protection privacy controls and encryption
• Partner with business continuity disaster recovery operations and risk leaders to strengthen cyber resilience.

Integrated Governance Risk & Compliance (GRC)

• Implement and operate a fully integrated enterprise GRC program spanning cybersecurity physical security privacy and operational risk.
• Establish cloud identity infrastructure application data and third-party security standards guardrails and governance practices that enable secure enterprise modernization.
• Maintain an enterprise security risk register with formal risk acceptance and exception governance.
• Support internal external and regulatory audits; ensure audit readiness and timely remediation.
• Serve as executive sponsor of internal and external security assessments.

Zero Trust Strategy & Implementation

• Own and execute the enterprise Zero Trust strategy and roadmap.
• Implement Zero Trust principles across:
  • Identityfirst access controls and strong authentication
  • Least privilege and privileged access management (PAM)
  • Network segmentation and microsegmentation
  • Continuous verification based on user device and risk context
• Establish metrics to measure Zero Trust adoption and reduction in attack surface.

Physical Security

• Provide strategic oversight for physical security programs protecting personnel facilities substations and critical infrastructure.
• Ensure alignment between physical access controls identity systems and enterprise risk posture.
• Coordinate with internal stakeholders and external partners as appropriate.
• Appropriately leverage guard force and physical security technology to reduce physical security risk.

Incident Response & Crisis Leadership

• Lead enterprise security incident response governance and coordinate cyber/physical security response capabilities
• Ensure clear command structure escalation protocols and coordination with Legal Communications HR Operations and executive leadership.
• Ensure security lessons learned are captured and incorporated into continuous improvement efforts.

People Budget and Vendor Management

• Lead a multidisciplinary organization spanning cybersecurity OT security IAM GRC and physical security.
• Manage budgets prioritize investments and oversee vendor and partner relationships.
• Establish operating model decision rights and accountability across security domains.
• Own workforce planning budgeting and vendor strategy.
• Ensure security capabilities scale with business growth and transformation.

Management Responsibilities

• Ensure that the Companys management principles policies and programs are consistently practiced and continually support the Affirmative Action Plan.
• Assume fiduciary responsibility for operating the business and provide recommendations on cost improvement measures.
• Ensure that the Performance Management program is administered uniformly and effectively.
• Comply with and administer the terms and conditions of the Collective Bargaining Agreement when applicable.
• Administers personnel functions including recruiting review and approval of job descriptions and salary classifications and selection and placement of personnel. Participates in hiring termination promoting assignment and direction of staff. Ensure compliance with all applicable local state and federal laws regulations and standards company policies practices and ethical obligations to investigate evaluate and recommend appropriate resolution to employee complaints.
• Promotes and participates in the professional development personal growth and career planning of staff. Motivate recognize and reward coach counsel train; provide feedback to employees during performance reviews. Participates in Leadership Development programs.
• Addresses disciplinary and/or performance issues according to company policy and communicates effectively with employees regarding corrective action. Has input into the adjustment of grievances and administration of discipline.
• Plans day-to-day operations estimates personnel needs and schedules and assigns work. Evaluate the structure and team plan for continual improvement of the efficiency and effectiveness of the group.

Knowledge Skills & Abilities

(Equivalent combination of education and experience will be considered.)

Minimum Qualifications

Bachelors degree in Information Security Computer Science Engineering Business or related field (or equivalent experience).

8 years of progressive leadership experience in enterprise security risk technology or critical infrastructure roles including experience leading cross-functional security programs.

Strong understanding of regulated environments and audit programs.

Experience working across both IT and OT environments.

Proven executive communication and stakeholder engagement skills.

Preferred Qualifications

Experience functioning as the seniormost security leader

Experience in utilities energy or critical infrastructure industries.

Demonstrated success with cloud security and Zero Trust transformations.

Deep experience implementing integrated GRC programs.

SOC and incident response modernization experience.

Relevant certifications (preferred): CISSP CISM CRISC CCSP GIAC (GICSP) PMP.

Masters degree (MBA MS Cybersecurity or related).

ADA Requirements and Physical Demands: Update below to match physical demands of the role.

The physical demands as described are representative of those that must be met by the person in this position to successfully perform the essential functions of the job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Office Work:
  • Sit Stand Walk and Bend: This position regularly requires prolonged periods of sitting. Occasionally requires standing walking or bending for short periods of time.
  • Use of Hands/Fingers: To operate a computer keyboard mouse and other office equipment.
  • Speech/Hearing: This position frequently communicates with others via phone and in-person.
  • Visual Acuity: For reviewing detailed operational reports.
• Lifting: Ability to lift and carry items weighing up to 15 pounds as needed.
• Safety Sensitive: This position does not perform safety sensitive functions.
• Travel: Regular travel to operational sites industry events and stakeholder meetings.