Director - Cyber Security

• Strategic Role

  • The Head of Cyber Security provides leadership and oversight in the strategic planning, execution, and assessment of all cyber security strategies, policies, procedures, and guiding practices to be implemented across IT and OT environments.
  • The position establishes and leads a comprehensive EGA-wide information security program to ensure that all IT and OT assets are adequately protected against current/future as well as internal/external threats.
  • The position is responsible for identifying, directing, coordinating, evaluating, and reporting on information security risks in a manner that meets compliance and industry requirements while enabling the organization to respond to and mitigate cyber security and information risks.
  • The position serves as the key liaison and focal point for all information security communications and initiatives, as well as coordinates internal staff, external resources, national and international agencies, and related third parties.
  • The Head of Cyber Security works closely with automation control system leads and OT cybersecurity champions to establish security controls for the OT environment and secure the integration of IT and OT networks/environments while maintaining segmentation to prevent lateral movement to critical OT systems.
  • The position may also be responsible for budgeting, project prioritization, industry and media relations, and providing testimony and advice to leadership and executive agencies on matters of cyber security.
  • The Head of Cyber Security should have deep knowledge of technology, infrastructure (e.g., cloud, on-premise, server environments), automation and control systems, OT security, and secure OT architecture to support the organization in advancing its digital ecosystem and cyber security.

  Budget

  • Oversees the consolidation and recommends the Cyber Security budget for both IT and OT environments and monitors financial performance against the budget so that the business is aware of anticipated costs/revenues, areas of unsatisfactory performance are identified, and potential areas of cost reduction or performance improvement are capitalized upon.

  Training & Awareness

  • Manages the development of staff training and awareness programs on all enterprise IT and OT security best practices.
  • Provides support, training, and guidance to EGA management and staff to ensure all security management policies, standards, and procedures are understood.
  • Monitors and audits implementation to ensure policies are adhered to.

  Relationship Management

  • Establishes effective relationships with plant managers, plant control system engineers, plant instrumentation engineers, and other OT teams to work closely with them to secure OT environments and enhance monitoring against emerging cyber threats.
  • Develops and maintains effective business relationships with all relevant internal departments and external entities such as vendors, contractors, consultants, and other stakeholders, maintaining the highest standards of business ethics.
  • Promptly attends to all critical issues to ensure the services required by the organization are delivered in the most effective manner.

  Leadership

  • Manages the effective achievement of departmental objectives through the leadership of the Cyber Security department.
  • Sets individual objectives, recruits qualified staff, manages performance, develops and motivates staff, and provides formal and informal feedback and appraisals to maximize subordinate and departmental performance.

  Safety, Quality & Environment

  • Ensures compliance with all relevant safety, quality, and environmental management policies, procedures, and controls across the department to guarantee employee safety, legislative compliance, and a responsible environmental attitude.
  • Ensures the implementation of security controls in the OT environment in a manner that does not compromise the performance of OT systems, affect the safety of control systems, or lead to disruption of production and plant operations.

  Authority / Decision Making

  • Operates within defined policies and objectives under general direction. The application of policies is defined by the job holder, who must establish the plan, determine priorities, and prescribe the processes needed to achieve objectives.
  • Work is subject to broad practices and procedures, with general direction provided.
  • Works with the 1st and 3rd LoD to ensure that the cybersecurity operations team and auditing teams are aligned on the organization's cyber protection.

Desired Candidate Profile

• Minimum Qualifications

  • Bachelor’s degree in Computer Engineering, Computer Science, or equivalent.
  • Certifications such as CRISC, PMP, CISA, CISM, GICSP, ISO 27001 Lead Auditor, etc. are highly desirable.

  Minimum Experience

  • 10–15 years of experience in IT and OT systems, IT and OT systems security, on-premise and cloud infrastructures, networking, system development, and IT/OT security management, including overseeing cyber security operations, preferably within a large manufacturing organization, with at least four (4) years in positions of progressively increasing managerial responsibilities.
  • Experience in managing IT/OT security vendors and contractor relationships.

  Skills

  • Ability to create, manage, and maintain effective relationships with a wide range of individuals and groups to provide technical and managerial counsel and influence stakeholders through a broad array of information.
  • Ability to engage effectively with EGA leadership and Board, security and law enforcement agencies, external vendors, and professional cyber security organizations.
  • Ability to manage staff possessing highly technical skills in a rapidly changing environment.
  • Strong understanding of the aluminium manufacturing sector and EGA’s products and business strategies.
  • Strong understanding of industrial automation control systems and security of OT environments.
  • Strong knowledge of security architecture and secure integration between IT and OT environments.
  • Strong understanding of IT/OT technologies, markets, and vendors, including firewalls, intrusion detection, assessment tools, encryption, certificate authority, web technologies, and application development.
  • Strong knowledge of information systems industry standards and best practices in network, application, and hardware platform security.
  • Knowledge of audit and assessment methodologies, procedures, and best practices relating to information networks, systems, and applications.
  • Detailed technical expertise in cloud architectures, including hybrid on-premise environments, particularly Microsoft Azure, as well as networks, routers and switches, wireless technologies, and IoT platforms.
  • Experience managing the security of cloud IaaS, PaaS, and SaaS services on Microsoft Azure, including Microsoft 365, ServiceNow, and Databricks.
  • Strong understanding of application security, database technologies used to store enterprise information, directory services, financial information, and information systems auditing.
  • Strong knowledge of identity and access management, security program policies, processes, standards, requirements, procedures, and supporting security technologies.

  Core Competencies

  • Managing advanced IT and OT security technical staff within an organizational environment.
  • Understanding business objectives and planning processes required to achieve them, as well as legislative and political processes that influence them.
  • Working effectively with diverse groups, including legislative and judicial bodies, law enforcement, technical information staff, government employees, media, and the general public.
  • Communicating complex technical issues effectively to non-technical employees.
  • Motivating and supporting staff to achieve business objectives.
  • Communicating industry standards, best practices, testing techniques, and the interpretation of assessments, testing results, and metrics.
  • Interpreting industry best-practice information and assessment results to provide consultative direction.
  • Providing assistance in the identification, prioritization, and remediation of system vulnerabilities to diverse users.
  • Managing large and complex projects, including planning, management, and coordination of diverse technical projects.
  • Leading complex projects, establishing priorities, and allocating resources and workloads within a team environment.
  • Developing collaboration among diverse agencies and offices, government bodies, and other agency groups to motivate stakeholders to act on requirements and risk-management recommendations.