Director, Security & Compliance (IT)

Role Description:

The Director, Security & Compliance leads an integrated program spanning information technology/operational technology (IT/OT) security, cyber risk management, compliance frameworks, internal controls, third-party risk governance, and board-level assurance. This executive role consolidates fragmented security, privacy, compliance, and governance accountabilities under the unified leadership of the Chief Information Officer and Executive Vice-President and maintains independent assurance relationships with the Audit & Risk Committee.

Essential Duties & Responsibilities:

• Develops and executes a comprehensive IT/OT security strategy aligned with critical-infrastructure expectations (NIST CSF, ICS-CERT, AWIA 2013, CIP standards).
• Develops and enforces third-party risk governance including security assessments, Request for Proposal (RFP) security requirements, contract risk clauses, and ongoing vendor assurance for critical suppliers (cloud, OT, databases, integrators).
• Subscribes to and operationalizes water-sector threat intelligence (CISA water-sector ISAC, EPA alerts, sector-specific ATT&CK). Briefs leadership on emerging threats and mitigation requirements.
• Owns DC Water's compliance posture across AWIA risk-and-resilience (Section 2013), EPA SDWA cybersecurity expectations, PCI-DSS (if payment systems are in scope), and municipal/federal audit requirements.
• Leads comprehensive segregation-of-duties (SOD) remediation across Oracle Fusion ERP and related financial systems. Implements an SOD ruleset covering Procure-to-Pay, Record-to-Report, and ITGC. Collaborates with Finance and Internal Audit to verify closure of related audit findings.
• Coordinates response to external audits (federal oversight, CPA firms) and internal audit programs. Tracks audit findings through closure; maintains evidence and attestation documentation.
• Ensures compliance with privacy expectations (FERPA for school data, general PII safeguards, vendor data-sharing agreements). Establishes data governance policies and stewardship roles.
• Establishes formal dotted-line reporting to the Audit & Risk Committee. Provides quarterly/ad-hoc governance and compliance status reports. Maintains independence in assurance function while supporting the CIO/EVP's operational authority.
• Develops, maintains, and publishes Information Security, Compliance, and Governance policies. Establishes standards for technology risk, vendor risk, data handling, and incident response. Manages policy exceptions and waivers.
• Chairs or co-chairs technology governance forums (e.g., IT Steering Committee, Risk Management Committee, Third-Party Risk Council) to coordinate cross-functional decisions.
• Performs other related duties and projects as assigned at the discretion of the Chief Information Officer and Executive Vice-President.

Supervisory Responsibilities: Directs a group of consultants and employees to ensure the security program and objectives are met.

Key Working Relationships: Interacts with Senior and Executive Level Staff members and employees throughout the Authority and representatives from other utilities and other government organizations and agencies.

Required Skills & Qualifications

Required Experience:

• A minimum of ten (10) years of progressive experience in Information Technology, IT Security, Compliance & Governance, or a related technical field, including at least seven (7) years of management experience.
• Demonstrated experience leading security, compliance, or governance teams; managing multi-disciplinary staff and external vendor relationships.
• Direct experience with external audit processes (financial statement audits, regulatory audits, third-party assurance).
• Working knowledge of multiple compliance frameworks (NIST CSF, CIS Controls, ISO 27001, COBIT, COSO, SOC2).
• Working knowledge of IT/OT security, SCADA/ICS environments, and critical infrastructure.
• Familiarity with risk management tools, vulnerability management, and security metrics.

Minimum Education Requirements:

• Bachelor’s degree in Information Technology/Information Security Systems or a related technical field or the equivalent combination of education and experience consisting of a High School Diploma or General Educational Development certificate (GED) and a minimum of fourteen (14) years of progressive experience in Information Technology, IT Security, Compliance & Governance, or a related technical field, including at least seven (7) years of management experience.

Required Skills:

• Ability to build trust across IT, Finance, Legal, Operations, and Board stakeholders with competing priorities.
• Understanding of audit frameworks, regulatory expectations, and how to position the organization for external review.
• Experience driving cultural and organizational change in security-conscious environments.

Physical Requirements:

• General office conditions.
• Periodic travel to treatment facilities, pump stations, and field infrastructure for security assessments and incident response.
• On-call availability for security incidents; participation in 24/7 incident escalation protocols.