Director, OT Operations, Cybersecurity, Governance

This is a fully remote position, open to applicants in United States.

📋 Description

• Define and implement a multiyear operational technology (OT) strategy and roadmap that aligns with fleet expansion, operational priorities, cybersecurity risks, and business goals.

• Establish the operational model for OT, including service ownership, decision-making rights, accountability, and performance expectations across internal teams and service providers.

• Mentor and develop a multidisciplinary team focused on OT operations, engineering, governance, and cybersecurity.

• Create annual operating and capital budgets, business cases, staffing plans, and set investment priorities.

• Prioritize initiatives based on risk, reliability, lifecycle conditions, regulatory obligations, cost, and business value.

• Deliver executive-level reports on OT strategy, financial performance, resource requirements, material risks, and delivery milestones.

• Own and manage the OT cybersecurity program, including the control framework, roadmap, and risk-based priorities.

• Oversee asset inventory, network segmentation, vulnerability management, secure configurations, patching, endpoint protection, and security monitoring.

• Set requirements for identity management, privileged access, multifactor authentication, vendor remote access, removable media, and transient cyber assets.

• Lead preparations for OT cyber incidents, including response, escalation, communication, lessons learned, and tracking corrective actions.

• Coordinate threat intelligence, detection engineering, security monitoring, and response workflows with enterprise cybersecurity and site operations.

• Measure and communicate the maturity of cybersecurity practices, the effectiveness of controls, exposure trends, remediation progress, and residual risk.

• Supervise compliance with NERC CIP, O&P, and internal obligations; convert requirements into procedures, controls, evidence standards, and operational routines.

• Maintain audit-ready documentation and evidence; lead readiness assessments, internal reviews, auditor engagement, evidence requests, and remediation planning.

• Develop and maintain an OT risk management framework, including a risk register, control library, exception processes, and accountable risk owners.

• Facilitate risk assessments for sites, systems, projects, vendors, architectural changes, acquisitions, and emerging threats.

• Define remediation plans, compensating controls, target dates, escalation criteria, and risk acceptance requirements.

• Align OT governance with the NIST Cybersecurity Framework (CSF) and NIST SP 800-82.

• Direct the everyday delivery of SCADA, control systems, OT networks, servers, workstations, historians, communications, and supporting services.

• Establish service levels, operating procedures, on-call coverage, escalation protocols, maintenance windows, and incident/problem management practices.

• Govern processes related to change, configuration, release, capacity, availability, and lifecycle management.

• Support the development of resilient architecture, tested backups, disaster recovery, continuity plans, redundancy, and restoration exercises.

• Coordinate commissioning, operational acceptance, documentation, support transition, and standardization for new or acquired assets.

• Promote root cause analysis, corrective actions, technical debt reduction, automation, and continuous improvement initiatives.

• Define security, service, documentation, support, resilience, notification, and access requirements for OT vendors and service providers.

• Lead technical due diligence, cybersecurity assessments, product selection, contract input, and onboarding for third-party and managed services.

• Manage vendor identities, privileged access, remote connectivity, session oversight, approval workflows, and timely access removal.

• Monitor service levels, control performance, vulnerabilities, end-of-life exposure, support quality, costs, and corrective actions.

• Ensure contracts cover incident reporting, breach notifications, evidence support, data handling, business continuity, and exit obligations.

• Maintain strategic supplier relationships and escalate significant performance, cybersecurity, compliance, or delivery issues.

• Collaborate with operations, engineering, asset management, IT, enterprise cybersecurity, compliance, legal, procurement, finance, and project delivery teams.

• Translate operational needs and technical risks into priorities, investment decisions, delivery plans, and executive recommendations.

• Support project design reviews, architectural decisions, commissioning, acquisitions, integrations, and operational transitions.

• Facilitate governance forums that address competing priorities, approve exceptions, assign accountability, and eliminate delivery barriers.

• Define performance, risk, control, service, reliability, recovery, financial, and delivery indicators.

• Create dashboards and reporting schedules for operational and executive stakeholders.

• Monitor availability, incidents, vulnerabilities, patch status, backup success, recovery testing, lifecycle exposure, and remediation performance.

• Conduct control testing, service reviews, maturity assessments, post-incident analyses, and independent assurance activities.

• Validate corrective actions and utilize performance and risk trends to inform investment, resource allocation, process improvements, and roadmap modifications.

⛳️ Requirements

• Advanced technical degree in areas such as engineering, computer science, information systems, or a related technical discipline.

• Over 10 years of relevant experience, including more than 5 years in a leadership role, in OT operations, ICS/SCADA, industrial cybersecurity, or critical infrastructure technology.

• Proven track record of leading technical teams, managing vendors and budgets, and executing multiyear operational or cybersecurity programs across multiple facilities.

• Experience supervising technical and regulatory teams and programs, as well as advancing program maturity.

• Demonstrated success in establishing and maintaining regulatory compliance programs.

• Familiarity with NERC processes and the capability to oversee audits and data requests.

• Experience in establishing governance, risk management, change control, compliance evidence, and effective business continuity and disaster recovery processes.

• Ability to translate technical and operational risks into executive decisions, foster cross-functional alignment, and balance cybersecurity, reliability, cost, and business priorities.

• Commitment to embodying the mission and values of Cypress Creek Energy.

• Preferred: Leadership experience in ICS/SCADA or OT environments within solar, storage, wind, utilities, or other distributed energy infrastructures.

• Preferred: Experience leading NERC CIP and O&P compliance efforts, evidence readiness, and audit remediation.

• Preferred: Familiarity with NIST 800-82 and NIST CSF.

• Preferred: Experience in selecting and governing comparable OT/cybersecurity tools, including vendor evaluations, service integration, and lifecycle planning.

• Preferred: Relevant certifications such as CISSP, CISM, CRISC, GICSP, or CEH.

🏝️ Benefits

• 15 days of Paid Time Off, with accrual up to 20 days, plus 11 observed holidays.

• 401(k) Match.

• Comprehensive benefits package that includes medical, dental, vision, and health insurance.

• Wellness stipend.

• Family planning stipend.

• Generous parental leave.

• Tuition Reimbursement.

• Phone Bill Reimbursement.

• Company Swag.

• Opportunities for professional growth.

• Possibilities to take ownership, expand expertise, and advance your career.