Senior Manager, Cybersecurity

Apex Clean Energy•Charlottesville, VA

1d•Onsite

About The Position

The Senior Manager, Cybersecurity owns and leads Apex Clean Energy’s cybersecurity program across corporate IT, cloud, and operational technology environments. Reporting to the Director of Integrated Technology Solutions, this is a senior individual-contributor role with no direct reports and authority to establish security standards, review significant technology changes, direct security work performed by ITS engineers and operations staff, and take immediate protective action against active threats. Business leaders retain responsibility for accepting material residual risk. The role matures an established cybersecurity program by translating strategy into durable standards, stronger risk decisions, and practices that keep pace with changes in the business and threat landscape. It has broad scope and direct access to leadership, and is supported by ITS infrastructure, systems engineering, and operations teams, as well as a 24/7 managed security partner that provides monitoring and initial response. The Senior Manager serves as the senior escalation point for incidents, including after hours. Responsibilities span cybersecurity strategy and risk management, security operations, IT/OT boundary security and NERC CIP integration, incident response and resilience, and security requirements for emerging technologies and business enablement. The position is full-time, exempt, based in Charlottesville, Virginia, and involves 10% travel.

Requirements

At least 8 years of progressively responsible cybersecurity experience, including leading security programs or major initiatives across teams without direct reporting authority.
A track record of maturing an established security program through standards, risk management, and technical controls.
Hands-on experience with SIEM, EDR, firewalls, vulnerability management, IAM/PAM, and cloud security tooling, including personally investigating incidents.
Experience leading incident response and making time-sensitive decisions during active events.
Ability to distinguish technical findings from material business risk and explain the difference to senior leadership.
Sound judgment balancing security, operations, business priorities, and regulatory obligations.

Nice To Haves

CISSP, CISM, GICSP, GIAC, or comparable certification.
Working knowledge of NERC CIP as it applies to generation assets.
Experience in energy, utilities, or other critical infrastructure, including OT, ICS, or SCADA environments; IEC 62443 and NIST SP 800-82 familiarity is a plus.
Experience managing MSSPs, SOC providers, or incident response firms.
Experience assessing security risk in AI, SaaS, and automation adoption.

Responsibilities

Lead and evolve Apex’s cybersecurity strategy, roadmap, policies, and standards in partnership with the Director of ITS.
Run the cybersecurity risk program, including the risk register, system and vendor assessments, integration assessments, and security reviews of significant technology initiatives before implementation.
Report security posture, material risk, and program performance to leadership.
Oversee vulnerability management, endpoint protection, SIEM/SOC monitoring, network and firewall governance, and cloud security posture.
Own identity and access standards, including IAM, PAM, and account lifecycle.
Manage relationships with managed security, SOC, and incident response partners, including performance and escalation.
Direct ITS technical staff on security work and personally investigate threats and validate controls as needed.
Define cybersecurity requirements for the IT/OT boundary, including remote and vendor access, in partnership with SCADA/OT leadership.
Integrate NERC CIP cybersecurity requirements into Apex’s overall security framework.
Work with SCADA/OT leadership to extend incident response, monitoring, vulnerability management, and vendor risk programs to OT, including protection of critical backups.
Serve as incident commander for cybersecurity events, coordinating with Legal, Communications, leadership, insurers, forensics partners, regulators, and law enforcement.
Maintain incident response plans and playbooks and run regular tabletop exercises, including joint exercises with SCADA/OT.
Own IT disaster recovery and cyber recovery planning and testing, and coordinate enterprise business continuity.
Set security requirements for AI, SaaS, APIs, automation, data handling, and secrets management so teams can adopt new technology responsibly.
Lead security awareness, phishing simulation, and privileged-user training, and build security capability across ITS.
Take immediate protective action against active cybersecurity threats and serve as a senior escalation point during incidents, including after hours.

Benefits

Medical and dental coverage.
401(k) with corporate matching.
Responsible Paid Time Off and standard company holidays.
Comprehensive high-deductible health plans.
Dental and vision insurance plans.
Short-term and long-term disability insurance.
Group life insurance.
Flexible spending arrangements.
Company-paid parking and cell phone.
Fitness and wellness corporate discounts.
Base and bonus commensurate with experience.
Professional development opportunities, including on-the-job learning, hands-on experience, mentorship, onboarding, and formal development programs.
Opportunities to volunteer and give back to local communities.