Director Enterprise Security

Rappahannock Electric Cooperative•Fredericksburg, VA

About The Position

The Director, Enterprise Security, leads REC’s enterprise physical and protective security program. The role establishes risk-based strategy, standards, and controls to protect employees, members, visitors, facilities, substations, other electric assets and operations, executives and directors, physical information assets, and REC’s reputation. Program responsibilities include threat, risk, and vulnerability assessment; security technology and guarding; workplace-violence and threat-management support; investigations; incident response; protective intelligence and executive protection; security training; and continuous improvement. The Director works closely with Operations, IT/OT Security, Emergency Management, Safety, Human Resources, Legal, Facilities, Communications, Compliance, and law-enforcement and emergency-response partners to support reliable electric service and organizational resilience. The position owns physical security, jointly governs cyber-physical risk with IT/OT security, supports enterprise emergency management, and manages executive protection using documented, threat-based criteria. It reports to a senior executive with enterprise authority, with direct and unfiltered CEO access during significant threats and periodic reporting to an executive risk or audit committee. The position participates in an established on-call and incident-response structure and may require work outside normal hours during emergencies, storms, significant events, or credible threats. Regular travel to REC facilities and remote electric sites is required. Field conditions may include terrain, weather, noise, and electrical hazards. The incumbent must follow site-access, PPE, driving, safety, confidentiality, and fitness-for-duty requirements. Physical functions may include occasional handling of equipment and supplies weighing up to 50 pounds, extended walking or standing, movement over uneven terrain and stairs, and other inspection and response activities. The role may require operating a vehicle, security equipment, computers, radios, and communications devices, and working outdoors in varying weather and lighting conditions.

Requirements

Bachelor’s degree in a relevant field or an equivalent combination of education and directly relevant experience.
Ten years of progressively responsible experience in security, critical infrastructure, emergency management, military, intelligence, or law enforcement.
Five years leading personnel, contractors, programs, and budgets.
Demonstrated experience with multi-site risk assessments, security systems, incident management, investigations, policy development, training, and executive communication.
Valid driver’s license and satisfaction of REC driving requirements.
United States citizenship.
Ability to obtain and maintain the Virginia Department of Criminal Justice Services (DCJS) registration applicable to assigned duties and, when applicable, DCJS compliance agent certification, including required background checks, training, and renewals.
Ability to complete and maintain firearms training and qualification and obtain the DCJS firearms endorsement for assigned armed duties, including applicable personal protection duties; compliance with REC authorization, safe handling, and annual requalification requirements.
Ability to participate in an established on-call and incident-response structure and work outside normal hours during emergencies, storms, significant events, or credible threats.
Ability to travel regularly to REC facilities and remote electric sites and comply with site-access, PPE, driving, safety, confidentiality, and fitness-for-duty requirements.
Ability to meet the role’s physical and functional demands, which may include occasionally handling equipment and supplies weighing up to 50 pounds, extended walking and standing, traversing uneven ground and stairs, and responding to alarms and incidents.
Enterprise risk and security-program leadership; critical-infrastructure and electric-utility awareness; threat, risk, and vulnerability assessment; physical-security technology and layered protection; incident command, crisis judgment, and investigations; people leadership, contractor governance, and financial stewardship; executive presence, discretion, and Board-level communication; cross-functional influence, change management, and cooperative/member orientation; ethics, confidentiality, fairness, and sound documentation.

Nice To Haves

Energy, utility, and cooperative experience.
A recognized security or continuity certification.
Incident Command System (ICS) and National Incident Management System (NIMS) training appropriate to assigned duties.

Responsibilities

Develop and maintain a multi-year enterprise security strategy, annual work plan, policies, standards, site-classification methodology, risk register, budget, and performance dashboard.
Brief executive leadership and the Board or designated committee on material risks, incidents, trends, investments, and corrective actions.
Direct documented threat, risk, and vulnerability assessments for offices, service centers, substations, warehouses, control and communications sites, public events, and other critical locations; prioritize mitigation based on consequence, likelihood, operational dependency, and cost.
Set and assure layered physical-protection standards, including perimeter protection, locks and keys, access control, visitor and vendor management, video surveillance, alarms, intrusion detection, lighting, communications, and response procedures.
Govern physical-security systems’ business requirements, maintenance, testing, integration, cyber coordination, records and privacy controls, replacement planning, and vendor performance; participate in design reviews for new construction and major modifications.
Lead employees and contracted security resources; establish post orders, service levels, training, supervision, escalation, quality assurance, and performance measures; ensure procurement and contractor decisions reflect risk and value.
Lead or coordinate security-incident response; establish notification and escalation criteria; conduct or oversee fair, lawful investigations; preserve evidence; coordinate with HR, Legal, IT/OT, Safety, and law enforcement; issue after-action findings; and track corrective actions to closure.
Co-lead a multidisciplinary workplace-violence and behavioral-threat process with HR and Legal; monitor credible threats and establish intake, assessment, case-management, privacy, referral, and intervention protocols.
Manage a scalable, intelligence-led protection program for executives and directors; conduct event, venue, route, and travel risk assessments as warranted; coordinate with hosts, venues, law enforcement, and qualified providers; and recommend proportionate coverage.
Serve in the assigned Incident Command System role; integrate security into emergency, storm-restoration, continuity, and crisis plans; plan and evaluate drills and exercises; document lessons learned; and support continuity of critical security services.
Partner with IT/OT Security and Operations on network-connected security systems, facility and OT access, remote vendor access, identity lifecycle, logging, cyber-physical incidents, and applicable critical-infrastructure standards; maintain clear accountability boundaries.
Maintain relationships with law enforcement, emergency management, first responders, neighboring utilities, industry security organizations, and information-sharing partners; coordinate reports and requests through authorized REC channels.
Develop role-based security awareness, workplace-violence reporting, de-escalation, incident reporting, executive and event security, and emergency-response training; conduct exercises and measure learning and program adoption.
Maintain assigned records and evidence; monitor applicable laws, regulations, standards, and leading practices; support audits and reviews; assess program effectiveness; and implement risk-based improvements.
Travel regularly to REC facilities and remote electric sites and comply with applicable site-access, PPE, driving, safety, confidentiality, and fitness-for-duty requirements.