Director Enterprise Security

Rappahannock Electric Cooperative•Fredericksburg, VA

4d•$153,166 - $179,970

About The Position

The Director, Enterprise Security, leads REC’s enterprise physical and protective security program. The Director establishes risk-based strategy, standards, and controls to protect employees, members and visitors, facilities, substations and other electric assets, operations, executives and directors, physical information assets, and REC’s reputation. The program covers threat, risk, and vulnerability assessment; security technology and guarding; workplace violence and threat management support; investigations; incident response; protective intelligence and executive protection; security training; and continuous improvement. The Director works closely with Operations, IT/OT Security, Emergency Management, Safety, Human Resources, Legal, Facilities, Communications, Compliance, law enforcement, and emergency-response partners to support reliable electric service and organizational resilience. The role owns physical security, jointly governs cyber-physical risk with IT/OT Security, supports enterprise emergency management, and manages executive protection using documented, threat-based criteria. The Director reports to a senior executive with enterprise authority and has direct and unfiltered access to the CEO during significant threats, with periodic reporting to an executive risk or audit committee. The position participates in an established on-call and incident-response structure and may require work outside normal hours during emergencies, storms, significant events, or credible threats. Regular travel is required to REC facilities and remote electric sites, where terrain, weather, noise, electrical hazards, and other field conditions may be present. The incumbent must comply with site-access, PPE, driving, safety, confidentiality, and fitness-for-duty requirements.

Requirements

Bachelor’s degree in a relevant field or an equivalent combination of education and directly relevant experience.
At least 10 years of progressively responsible experience in security, critical infrastructure, emergency management, military, intelligence, or law enforcement.
At least five years leading personnel, contractors, programs, and budgets.
Demonstrated experience with multi-site risk assessments, security systems, incident management, investigations, policy development, training, and executive communication.
Valid driver’s license and ability to satisfy REC driving requirements.
United States citizenship.
Ability to obtain and maintain Virginia Department of Criminal Justice Services (DCJS) registration applicable to assigned duties and, when applicable, DCJS compliance agent certification, including required background checks, training, and renewals.
Ability to complete and maintain firearms training and qualification and obtain the DCJS firearms endorsement for assigned armed duties, including applicable personal protection duties; compliance with REC authorization, safe-handling, and annual requalification requirements.
Ability to meet site-access, personal protective equipment, driving, safety, confidentiality, and fitness-for-duty requirements.
Ability to travel regularly to REC facilities and remote electric sites and to participate in on-call and incident-response duties, including work outside normal hours during emergencies, storms, significant events, or credible threats.
Physical and functional demands may include occasionally lifting, carrying, pushing, or pulling equipment and supplies up to 50 pounds; walking and standing for extended periods on uneven ground, gravel, stairs, and outdoor utility sites; climbing stairs; bending, stooping, kneeling, crouching, reaching, and maintaining balance.
Ability to operate a motor vehicle, security equipment, computers, radios, and communications devices; use hands for keys, controls, writing, and equipment handling; observe and assess conditions through visual and auditory information; communicate clearly in person and by radio or telephone; and respond promptly to alarms and incidents, with appropriate aids or accommodations.

Nice To Haves

Energy, utility, and cooperative experience.
A recognized security or continuity certification.
Incident Command System (ICS) and National Incident Management System (NIMS) training appropriate to assigned duties.

Responsibilities

Develop and maintain a multi-year enterprise security strategy, annual work plan, policies, standards, site-classification methodology, risk register, budget, and performance dashboard aligned with REC’s mission, risk tolerance, and reliable electric service.
Brief executive leadership and the Board or designated committee on material risks, incidents, trends, investments, and corrective actions.
Direct documented threat, risk, and vulnerability assessments for offices, service centers, substations, warehouses, control and communications sites, public events, and other critical locations; prioritize mitigation based on consequence, likelihood, operational dependency, and cost.
Set and assure layered physical-protection standards, including perimeter protection, locks and keys, access control, visitor and vendor management, video surveillance, alarms, intrusion detection, lighting, communications, and response procedures.
Own business requirements, governance, maintenance, testing, integration, cyber coordination, records and privacy controls, replacement planning, and vendor performance for physical-security systems; participate in design reviews for new construction and major modifications.
Lead employees and contracted security resources; establish post orders, service levels, training, supervision, escalation, quality assurance, and performance measures; ensure procurement and contractor decisions reflect risk and value.
Lead or coordinate security-incident response; establish notification and escalation criteria; conduct or oversee fair and lawful investigations; preserve evidence; coordinate with HR, Legal, IT/OT, Safety, and law enforcement; issue after-action findings; and track corrective actions to closure.
Co-lead a multidisciplinary workplace-violence and behavioral-threat process with HR and Legal; monitor credible threats and establish intake, assessment, case-management, privacy, referral, and intervention protocols.
Manage a scalable, intelligence-led protection program for executives and directors; conduct event, venue, route, and travel risk assessments as warranted; coordinate with hosts, venues, law enforcement, and qualified providers; and recommend coverage proportionate to threat and exposure.
Serve in the assigned Incident Command System role; integrate security into emergency, storm-restoration, continuity, and crisis plans; plan and evaluate drills and exercises; document lessons learned; and support continuity of critical security services.
Partner with IT/OT Security and Operations on network-connected security systems, facility and OT access, remote vendor access, identity lifecycle, logging, cyber-physical incidents, and applicable critical-infrastructure standards; maintain clear accountability boundaries.
Maintain relationships with federal, state, and local law enforcement, emergency management, first responders, neighboring utilities, industry security organizations, and information-sharing partners; coordinate reports and requests through authorized REC channels.
Develop role-based security awareness, workplace-violence reporting, de-escalation, incident reporting, executive and event security, and emergency-response training; conduct exercises and measure learning and program adoption.
Maintain assigned records and evidence; monitor applicable laws, regulations, standards, and leading practices; support audits and reviews; assess program effectiveness; and implement risk-based improvements.