Director - Cyber Security

Strategic Role The Head of Cyber Security provides leadership and oversight in the strategic planning, execution, and assessment of all cyber security strategies, policies, procedures, and guiding practices to be implemented across IT and OT environments. The position establishes and leads a comprehensive EGA-wide information security program to ensure that all IT and OT assets are adequately protected against current/future as well as internal/external threats. The position is responsible for identifying, directing, coordinating, evaluating, and reporting on information security risks in a manner that meets compliance and industry requirements while enabling the organization to respond to and mitigate cyber security and information risks. The position serves as the key liaison and focal point for all information security communications and initiatives, as well as coordinates internal staff, external resources, national and international agencies, and related third parties. The Head of Cyber Security works closely with automation control system leads and OT cybersecurity champions to establish security controls for the OT environment and secure the integration of IT and OT networks/environments while maintaining segmentation to prevent lateral movement to critical OT systems. The position may also be responsible for budgeting, project prioritization, industry and media relations, and providing testimony and advice to leadership and executive agencies on matters of cyber security. The Head of Cyber Security should have deep knowledge of technology, infrastructure (e.g., cloud, on-premise, server environments), automation and control systems, OT security, and secure OT architecture to support the organization in advancing its digital ecosystem and cyber security. Budget Oversees the consolidation and recommends the Cyber Security budget for both IT and OT environments and monitors financial performance against the budget so that the business is aware of anticipated costs/revenues, areas of unsatisfactory performance are identified, and potential areas of cost reduction or performance improvement are capitalized upon. Training & Awareness Manages the development of staff training and awareness programs on all enterprise IT and OT security best practices. Provides support, training, and guidance to EGA management and staff to ensure all security management policies, standards, and procedures are understood. Monitors and audits implementation to ensure policies are adhered to. Relationship Management Establishes effective relationships with plant managers, plant control system engineers, plant instrumentation engineers, and other OT teams to work closely with them to secure OT environments and enhance monitoring against emerging cyber threats. Develops and maintains effective business relationships with all relevant internal departments and external entities such as vendors, contractors, consultants, and other stakeholders, maintaining the highest standards of business ethics. Promptly attends to all critical issues to ensure the services required by the organization are delivered in the most effective manner. Leadership Manages the effective achievement of departmental objectives through the leadership of the Cyber Security department. Sets individual objectives, recruits qualified staff, manages performance, develops and motivates staff, and provides formal and informal feedback and appraisals to maximize subordinate and departmental performance. Safety, Quality & Environment Ensures compliance with all relevant safety, quality, and environmental management policies, procedures, and controls across the department to guarantee employee safety, legislative compliance, and a responsible environmental attitude. Ensures the implementation of security controls in the OT environment in a manner that does not compromise the performance of OT systems, affect the safety of control systems, or lead to disruption of production and plant operations. Authority / Decision Making Operates within defined policies and objectives under general direction. The application of policies is defined by the job holder, who must establish the plan, determine priorities, and prescribe the processes needed to achieve objectives. Work is subject to broad practices and procedures, with general direction provided. Works with the 1st and 3rd LoD to ensure that the cybersecurity operations team and auditing teams are aligned on the organization's cyber protection.

Desired Candidate Profile

Minimum Qualifications Bachelor’s degree in Computer Engineering, Computer Science, or equivalent. Certifications such as CRISC, PMP, CISA, CISM, GICSP, ISO 27001 Lead Auditor, etc. are highly desirable. Minimum Experience 10–15 years of experience in IT and OT systems, IT and OT systems security, on-premise and cloud infrastructures, networking, system development, and IT/OT security management, including overseeing cyber security operations, preferably within a large manufacturing organization, with at least four (4) years in positions of progressively increasing managerial responsibilities. Experience in managing IT/OT security vendors and contractor relationships. Skills Ability to create, manage, and maintain effective relationships with a wide range of individuals and groups to provide technical and managerial counsel and influence stakeholders through a broad array of information. Ability to engage effectively with EGA leadership and Board, security and law enforcement agencies, external vendors, and professional cyber security organizations. Ability to manage staff possessing highly technical skills in a rapidly changing environment. Strong understanding of the aluminium manufacturing sector and EGA’s products and business strategies. Strong understanding of industrial automation control systems and security of OT environments. Strong knowledge of security architecture and secure integration between IT and OT environments. Strong understanding of IT/OT technologies, markets, and vendors, including firewalls, intrusion detection, assessment tools, encryption, certificate authority, web technologies, and application development. Strong knowledge of information systems industry standards and best practices in network, application, and hardware platform security. Knowledge of audit and assessment methodologies, procedures, and best practices relating to information networks, systems, and applications. Detailed technical expertise in cloud architectures, including hybrid on-premise environments, particularly Microsoft Azure, as well as networks, routers and switches, wireless technologies, and IoT platforms.

Keywords