Responsible for defining data protection policies, governance frameworks, privacy architecture standards, and investigative processes that ensure confidentiality, integrity, availability, and appropriate use of enterprise data
Provide strategic direction and oversight for data sovereignty, developing the governance structure, controls, and standards that business and technology teams follow across the organization
Drive Vulnerability & Patch Management (TVM)
Own the enterprise Threat & Vulnerability Management (TVM) program across IT and OT
Establish governance for patch management and risk-based remediation
Prioritize vulnerabilities based on business risk and ensure timely resolution
Oversee Incident Response & Threat Hunting
Lead enterprise incident response and proactive threat hunting capabilities
Ensure readiness through tested playbooks and crisis response processes
Drive continuous improvement through post-incident reviews and lessons learned
Optimize Security Tools & Investments
Manage the lifecycle, performance, and optimization of security tools and platforms
Align capabilities to the NIST Cybersecurity Framework (CSF)
Evaluate effectiveness, reduce redundancy, and ensure cost-efficient security investments
Strengthen Security Awareness & Culture
Oversee enterprise-wide security awareness and phishing simulation programs
Reduce human risk through targeted training and behavior-driven initiatives
Track effectiveness through measurable outcomes (e.g., phishing resilience, engagement)
Development and execution of table top exercises to verify ownership
Align Security with Business & Risk
Partner with IT, OT, and business leaders to integrate security into operations
Align cybersecurity strategy with business priorities, risk tolerance, and resilience goals
Communicate risk, performance, and priorities to senior leadership
This position has supervisory responsibilities.
Required
Minimum 15 years of cybersecurity experience, including leadership in security operations
Minimum 10 years’ experience in SOC operations, incident response, and vulnerability management
Minimum 10 years’ experience working with or overseeing third-party security providers (MDR/SOC)
Due to ITAR work requirements, Permanent Resident or US Citizen is required
Proven ability to align security strategy, tooling, and operations with business outcomes
Deep knowledge of frameworks such as NIST CSF and/or ISO 27001
Strong leadership, communication, and stakeholder engagement skills
Certifications such as CISSP or CISM
Desired
Experience in energy, oil & gas, or critical infrastructure environments
Familiarity with OT/ICS security (e.g., NIST 800-82, IEC 62443)
Experience managing security tooling strategy, optimization, and cost governance
Exposure to modern security technologies (SIEM, SOAR, EDR, MDR, cloud security)