Associate Director - Cybersecurity Risk and Compliance

• Roles and Responsibilities: • Conduct periodic and ad hoc cybersecurity risk assessments across IT and OT environments • Perform OT-specific risk assessments on assets such as PLCs, HMIs, RTUs, and engineering systems • Identify and document OT-relevant risk scenarios (e.g., control system disruption, unauthorized access, safety manipulation) • Coordinate risk reviews as part of major IT/OT changes, such as system upgrades or new deployments • Reassess risk posture following major changes, incidents, or regulatory updates • Review and validate existing controls to calculate residual risk and prioritize treatment actions • Provide standardized tools and guidance to support self-assessments by IT, OT, and business teams • Support integration of assessment outcomes into control design, zoning, segmentation, and system deployment • Track risk treatment progress and escalate overdue or high-priority items as needed • Coordinate with performance management to define and monitor key risk indicators (KRIs) to proactively track changes in cybersecurity risk exposure • Maintain the cybersecurity risk register, including OT-specific entries, capturing identified risks, likelihood and impact ratings, treatment plans, ownership, and status • Coordinate and execute internal cybersecurity compliance assessments across all relevant domains and functions • Serve as the lead interface for external audits and regulatory inspections, including preparation, execution, and response • Conduct periodic compliance assessments of OT environments, including SCADA, DCS, PLCs, and associated network infrastructure • Maintain an inventory of compliance-relevant OT assets and map them to applicable control requirements and standards • Monitor adherence to cybersecurity policies, escalate non-compliance, and coordinate corrective actions with relevant teams • Track and manage remediation plans for compliance gaps, non-conformities, and audit findings through closure • Validate the effectiveness of implemented controls or mitigation plans before closing compliance gaps • Review and validate configuration baselines for OT systems (e.g., firewall rules, firmware versions) to ensure alignment with compliance standards • Coordinate evidence collection, documentation, and remediation planning for compliance-related findings • Report OT and IT cybersecurity compliance status and risks to leadership and cybersecurity governance • Support compliance awareness and training for teams with control responsibilities in both IT and OT • Maintain a centralized compliance register, covering both IT and OT, that maps regulatory requirements to policies, controls, responsible teams, and evidence sources • Govern third-party cybersecurity risk by maintaining standardized assessment processes, due diligence criteria, and remediation tracking • Coordinate and conduct third-party cybersecurity assessments across IT and OT suppliers to ensure alignment with internal policies and regulatory requirements • Review vendor-supplied OT systems and supporting documentation to ensure inclusion of security controls and compliance with applicable standards (e.g., NCA OTCC, IEC 62443) • Ensure third-party risk findings are documented, risk-rated, and tracked through resolution, including acceptance or application of compensating controls • Maintain a register of assessed vendors, associated risks, control gaps, and remediation status for ongoing oversight and reporting • Collaborate with procurement, legal, and compliance to embed cybersecurity requirements into third-party agreements, including OT-specific clauses where applicable • Contribute to the development and review of third-party security policy and minimum control requirements for use in procurement and onboarding • Support internal and external audit requests related to third-party cybersecurity risk management Requirements • Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field. • Master's degree is preferred. • 10-12+ years of cybersecurity experience • Strong experience in cybersecurity risk management, compliance, assessments, and assurance

Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field. Master's degree is preferred. 10-12+ years of cybersecurity experience. Strong experience in cybersecurity risk management, compliance, assessments, and assurance.

Conduct periodic and ad hoc cybersecurity risk assessments across IT and OT environments; Perform OT-specific risk assessments on assets such as PLCs, HMIs, RTUs, and engineering systems; Identify and document OT-relevant risk scenarios (e.g., control system disruption, unauthorized access, safety manipulation); Coordinate risk reviews as part of major IT/OT changes, such as system upgrades or new deployments; Reassess risk posture following major changes, incidents, or regulatory updates; Review and validate existing controls to calculate residual risk and prioritize treatment actions; Provide standardized tools and guidance to support self-assessments by IT, OT, and business teams; Support integration of assessment outcomes into control design, zoning, segmentation, and system deployment; Track risk treatment progress and escalate overdue or high-priority items as needed; Coordinate with performance management to define and monitor key risk indicators (KRIs) to proactively track changes in cybersecurity risk exposure; Maintain the cybersecurity risk register, including OT-specific entries, capturing identified risks, likelihood and impact ratings, treatment plans, ownership, and status; Coordinate and execute internal cybersecurity compliance assessments across all relevant domains and functions; Serve as the lead interface for external audits and regulatory inspections, including preparation, execution, and response; Conduct periodic compliance assessments of OT environments, including SCADA, DCS, PLCs, and associated network infrastructure; Maintain an inventory of compliance-relevant OT assets and map them to applicable control requirements and standards; Monitor adherence to cybersecurity policies, escalate non-compliance, and coordinate corrective actions with relevant teams; Track and manage remediation plans for compliance gaps, non-conformities, and audit findings through closure; Validate the effectiveness of implemented controls or mitigation plans before closing compliance gaps; Review and validate configuration baselines for OT systems (e.g., firewall rules, firmware versions) to ensure alignment with compliance standards; Coordinate evidence collection, documentation, and remediation planning for compliance-related findings; Report OT and IT cybersecurity compliance status and risks to leadership and cybersecurity governance; Support compliance awareness and training for teams with control responsibilities in both IT and OT; Maintain a centralized compliance register, covering both IT and OT, that maps regulatory requirements to policies, controls, responsible teams, and evidence sources; Govern third-party cybersecurity risk by maintaining standardized assessment processes, due diligence criteria, and remediation tracking; Coordinate and conduct third-party cybersecurity assessments across IT and OT suppliers to ensure alignment with internal policies and regulatory requirements; Review vendor-supplied OT systems and supporting documentation to ensure inclusion of security controls and compliance with applicable standards (e.g., NCA OTCC, IEC 62443); Ensure third-party risk findings are documented, risk-rated, and tracked through resolution, including acceptance or application of compensating controls; Maintain a register of assessed vendors, associated risks, control gaps, and remediation status for ongoing oversight and reporting; Collaborate with procurement, legal, and compliance to embed cybersecurity requirements into third-party agreements, including OT-specific clauses where applicable; Contribute to the development and review of third-party security policy and minimum control requirements for use in procurement and onboarding; Support internal and external audit requests related to third-party cybersecurity risk management.