SVP/CISO Cyber and Product Security

Generac Power Systems•Waukesha, WI

14d

About The Position

The Senior Vice President Cybersecurity (Chief Information Security Officer – CISO) leads Generac’s global cybersecurity organization and reports to the Chief Information Officer. The role owns the enterprise security vision and multi-year roadmap, protecting information assets, global manufacturing operations, connected products, and the digital ecosystem against evolving threats. The CISO is accountable for measurable reduction of cyber risk across IT, OT, and product domains, and partners with executive leadership, product engineering, manufacturing operations, business stakeholders, and external partners. The CISO leads a global organization spanning security operations, cybersecurity engineering, governance, risk and compliance, product and IoT security, and OT/ICS security. This executive is responsible for strategy, leadership, and execution of global cybersecurity and product security programs, and represents cybersecurity to executive leadership, the Board of Directors, customers, and regulators. The position includes building and developing a high-performing global security organization; defining its operating model, organizational design, and budget; and managing multi-million-dollar program and technology investments. The CISO also champions security culture and accountability, positioning cybersecurity as a business enabler for Generac’s energy technology strategy.

Requirements

Bachelor’s degree focused in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
15 years of progressive cybersecurity experience, including at least 10 years in senior security leadership roles.
Prior experience as a CISO, Deputy CISO, or equivalent head of security in a Fortune 500 or comparable global enterprise.
Experience leading cybersecurity in industrial, manufacturing, or similarly complex global environments, including OT/ICS security and product or IoT security for connected products.
Track record of building, scaling, and retaining high-performing global security teams and maturing enterprise security programs against measurable outcomes.
Experience presenting to Boards of Directors, audit committees, and executive leadership, including cyber risk reporting and material incident communications.
Experience leading enterprise response to significant cyber incidents, including coordination with external counsel, forensic partners, insurers, law enforcement, and regulators.
Deep working knowledge of NIST CSF, ISO 27001, IEC 62443, MITRE ATT&CK, and SEC cybersecurity disclosure requirements.
Executive presence and exceptional communication skills, including the ability to explain technical risk in business terms to Boards, customers, and non-technical leaders.
Strategic vision and operational depth across IT, OT, cloud, identity, application, and product security.
Strong business acumen, including financial management of large security budgets, vendor negotiation, and cyber insurance strategy.
Sound judgment and decisiveness under pressure, with the ability to lead effectively during high-severity incidents.
Ability to influence without direct authority in a matrixed global environment, collaborate across functions, align stakeholders, and drive accountability around enterprise priorities.
Ability to build trust and align cross-functional stakeholders and teams that may not report directly to the role.
Ability to talk and hear; use hands to manipulate objects or controls; stand and walk regularly; and occasionally stoop, bend, reach above the shoulders, and lift up to 25 pounds.
Ability to perform frequent and continuous computer-based work requiring periods of sitting, close vision, and adjustment of focus.

Nice To Haves

Master’s degree in Cybersecurity, Computer Science, Engineering, or Business Administration (MBA).
CISSP, CISM, or equivalent executive-level security certification.
Experience in a publicly traded company subject to SEC cybersecurity disclosure rules.
Experience securing energy technology, power generation, or connected consumer or industrial products.

Responsibilities

Define and execute a multi-year enterprise cybersecurity strategy and roadmap aligned with business objectives and benchmarked against Fortune 500 industrial and manufacturing peers.
Advise the CIO, executive leadership team, and Board of Directors on cyber risk posture, investment priorities, and emerging threats.
Partner across business units, functions, and regions to balance risk, speed, operational continuity, and business growth.
Own product security for connected products, energy technology platforms, and IoT ecosystems, embedding secure-by-design and secure development lifecycle practices.
Establish and lead product security incident response (PSIRT), coordinated vulnerability disclosure, and compliance with emerging product security regulations and standards.
Partner with product engineering, manufacturing, operations, legal, compliance, and business leaders to embed security requirements in business processes, product development, and operational decisions.
Lead the security strategy for operational technology and industrial control systems across global manufacturing and distribution facilities while balancing risk reduction, production uptime, and safety.
Establish IT/OT convergence governance, segmentation and access standards, and incident response readiness for plant-floor environments.
Provide executive oversight of the global security operations center, incident response, threat intelligence, and vulnerability management, ensuring around-the-clock detection and response across internal teams and managed service partners.
Serve as executive incident commander for material cyber events, direct enterprise response, and lead communications with executive leadership, the Board, legal counsel, insurers, and regulators, including SEC materiality assessment and disclosure support.
Own the enterprise cyber risk management framework, security policy program, and control environment aligned with NIST CSF, ISO 27001, and applicable regulatory obligations, including certification and recertification processes for applicable products.
Direct security compliance, audit readiness, SOX-related IT control partnership, and customer assurance activities across global operations.
Own the third-party cyber risk management program for suppliers, service providers, and technology partners across the global manufacturing supply chain.
Govern strategic security vendors and managed service providers through service levels, performance reviews, and decisions about internal versus external capabilities.
Build, lead, and develop a high-performing global security organization, attract talent, develop future leaders, and establish succession depth across security disciplines.
Define the security operating model, organizational design, and budget; manage multi-million-dollar program and technology investments for maximum risk reduction per dollar.
Deliver clear, business-focused reporting on cyber risk, program maturity, and incident readiness to the executive leadership team and Board committees.
Champion enterprise-wide security culture, awareness, and accountability.