Director, OT Operations, Cybersecurity, and Governance

Cypress Creek Renewables

2d•Remote

About The Position

Cypress Creek Energy is seeking a Director to lead the strategy, delivery, and continuous improvement of operational technology services that monitor and control its generation sites. The role is accountable for reliable OT operations, consistent governance, adherence to NERC regulatory standards, and a risk-based cybersecurity program across SCADA and supporting infrastructure. The Director establishes priorities, leads technical teams and service providers, manages budgets and technology roadmaps, and partners across operations, engineering, IT, cybersecurity, and compliance to protect personnel, maintain availability, and support fleet growth while preserving safe operations. The Director owns OT cybersecurity and risk and compliance programs, including the control framework, security roadmap, risk assessments, regulatory readiness, audit evidence, and remediation. The role leads day-to-day delivery and lifecycle management of SCADA, control systems, OT networks, servers, workstations, historians, communications, and related services. It also governs OT vendors and third parties, supports cross-functional projects and operational handoffs, and establishes performance measures, assurance activities, and executive reporting. This is a remote position with travel up to 25%.

Requirements

Advanced technical degree in engineering, computer science, information systems, or a related technical field.
10+ years of relevant experience, including 5+ years of leadership, in OT operations, ICS/SCADA, industrial cybersecurity, or critical infrastructure technology.
Demonstrated experience leading technical teams, managing vendors and budgets, and delivering multiyear operational or cybersecurity programs across distributed facilities.
Experience overseeing technical and regulatory teams and programs, along with elevating program maturity.
Proven success implementing and maintaining regulatory compliance programs.
Knowledge of NERC processes and ability to oversee audits and data requests.
Experience establishing governance, risk management, change control, compliance evidence, and tested business continuity and disaster recovery processes.
Ability to translate technical and operational risks into executive decisions, build cross-functional alignment, and balance cybersecurity, reliability, cost, and business priorities.
Embrace and live by the mission and values of Cypress Creek Energy.

Nice To Haves

Leadership experience supporting ICS/SCADA or OT environments in solar, storage, wind, utilities, or other distributed energy infrastructure.
Experience leading NERC CIP and O&P compliance support, evidence readiness, and audit remediation.
Familiarity with NIST SP 800-82 and NIST CSF.
Experience selecting and governing relevant tools or comparable products, including vendor evaluation, service integration, and lifecycle planning.
Relevant certifications such as CISSP, CISM, CRISC, GICSP, or CEH.

Responsibilities

Define and execute a multiyear OT strategy and roadmap aligned with fleet growth, operational priorities, cybersecurity risk, and business objectives.
Establish the OT operating model, service ownership, decision rights, accountability, and performance expectations across internal teams and service providers.
Lead, mentor, and develop multidisciplinary OT operations, engineering, governance, and cybersecurity personnel.
Develop annual operating and capital budgets, business cases, staffing plans, and investment priorities for OT services and infrastructure.
Prioritize initiatives using risk, reliability, lifecycle condition, regulatory obligations, cost, and business value.
Provide executive-level reporting on OT strategy, financial performance, resource needs, material risks, and delivery milestones.
Own the OT cybersecurity program, control framework, roadmap, and risk-based priorities across generation sites and supporting infrastructure.
Direct asset inventory, network segmentation, vulnerability management, secure configuration, patching, endpoint protection, and security monitoring practices.
Establish requirements for identity, privileged access, multifactor authentication, vendor remote access, removable media, and transient cyber assets.
Lead OT cyber incident preparedness, response, escalation, communications, lessons learned, and corrective-action tracking.
Coordinate threat intelligence, detection engineering, security monitoring, and response workflows with enterprise cybersecurity and site operations.
Measure and communicate cybersecurity maturity, control effectiveness, exposure trends, remediation progress, and residual risk.
Provide leadership and oversight for applicable regulatory obligations, including NERC CIP and O&P requirements and internal compliance commitments.
Translate regulatory requirements into sustainable OT procedures, controls, evidence standards, ownership assignments, and operating routines.
Maintain audit-ready documentation and evidence for access, configuration, patching, vulnerability, incident, recovery, and change-management controls.
Partner with legal, compliance, operations, engineering, and cybersecurity teams to assess applicability and address control gaps.
Lead readiness assessments, internal reviews, regulator or auditor engagement, evidence requests, and remediation planning.
Track regulatory changes and update policies, standards, training, and technical controls within required time frames.
Establish and maintain an OT risk-management framework, risk register, control library, exception process, and accountable risk owners.
Facilitate risk assessments for sites, systems, projects, vendors, architecture changes, acquisitions, and emerging threats.
Evaluate risk in the context of personnel safety, reliable operations, generation availability, cybersecurity, regulatory exposure, and financial impact.
Define remediation plans, compensating controls, target dates, escalation criteria, and formal risk-acceptance requirements.
Align OT governance with recognized practices such as NIST CSF and NIST SP 800-82 while tailoring controls to operational realities.
Report material risk, overdue remediation, policy exceptions, control deficiencies, and trends to appropriate governance forums.
Direct reliable day-to-day delivery of SCADA, control systems, OT networks, servers, workstations, historians, communications, and supporting services.
Establish service levels, operational procedures, on-call coverage, escalation paths, maintenance windows, and incident and problem-management practices.
Govern change, configuration, release, capacity, availability, and lifecycle-management processes for production OT environments.
Sponsor resilient architecture, tested backups, disaster recovery, continuity plans, redundancy, and restoration exercises.
Coordinate commissioning, operational acceptance, documentation, support transition, and standardization for new or acquired assets.
Drive root-cause analysis, corrective actions, technical-debt reduction, automation, and continuous improvement of OT services.
Define security, service, documentation, support, resilience, notification, and access requirements for OT vendors and service providers.
Lead technical due diligence, cybersecurity assessments, product selection, contract input, and onboarding for third parties and managed services.
Govern vendor identities, privileged access, remote connectivity, session oversight, approval workflows, and timely access removal.
Monitor service levels, control performance, vulnerabilities, end-of-life exposure, support quality, costs, and corrective actions.
Ensure contracts address incident reporting, breach notification, evidence support, data handling, business continuity, and exit obligations.
Maintain strategic supplier relationships and escalate material performance, cybersecurity, compliance, or delivery concerns.
Partner with operations, engineering, asset management, IT, enterprise cybersecurity, compliance, legal, procurement, finance, and project delivery teams.
Translate operational needs and technical risks into clear priorities, investment decisions, delivery plans, and executive recommendations.
Align enterprise technology and security services with OT availability, safety, latency, supportability, and site-access requirements.
Support project design reviews, architecture decisions, commissioning, acquisitions, integrations, and operational handoffs.
Facilitate governance forums that resolve competing priorities, approve exceptions, assign accountability, and remove delivery barriers.
Promote shared ownership of OT reliability, cybersecurity, compliance, lifecycle planning, and continuous improvement across the organization.
Define key performance, risk, control, service, reliability, recovery, financial, and delivery indicators for the OT function.
Establish dashboards and reporting cadences that provide timely, accurate, and actionable visibility to operational and executive stakeholders.
Monitor service availability, incidents, vulnerabilities, patch status, backup success, recovery testing, lifecycle exposure, and remediation performance.
Conduct control testing, service reviews, maturity assessments, post-incident reviews, and independent assurance activities as appropriate.
Validate that corrective actions are evidence-based, sustainably implemented, assigned to accountable owners, and completed on schedule.
Use performance and risk trends to drive investment decisions, resource allocation, process improvement, and roadmap adjustments.