Director, Security & Compliance - (27-IT-601015-089)

Job Description

The intent of this job description is to provide a representative summary of the major duties, locations, and responsibilities performed by incumbent(s) in this job. Incumbent(s) may not be required to perform all duties in this description, and incumbent(s) may be required to perform work-related tasks other than those specifically listed in this description. This job description is not a "contract" between the employee and the Authority. The job duties and essential functions may be changed at the discretion of the General Manager.

GeneralJob Title:Director, Security & ComplianceJob Code:OA0506Supervises Directly:YesNew or Revised:NewRegular or At-Will:At-WillDate:10/8/2026Exempt or Non-Exempt:ExemptCompensation Approval Signature:Union / Non-Union:Non-Union
Division:

Department:

Information Technology

IT - Information Security
Salary Schedule: Non-Union Salary RangeCost Center Code: 601015Grade:ESSBEssential Position:YesReports To:Chief Information Officer and Executive Vice-PresidentEEO Code:Officials and AdministratorsWork Format:Hybrid

Role Description:
The Director, Security & Compliance leads an integrated program spanning information technology/operational technology (IT/OT) security, cyber risk management, compliance frameworks, internal controls, third-party risk governance, and board-level assurance. This executive role consolidates fragmented security, privacy, compliance, and governance accountabilities under the unified leadership of the Chief Information Officer and Executive Vice-President and maintains independent assurance relationships with the Audit & Risk Committee.

Essential Duties & Responsibilities:

• Develops and executes a comprehensive IT/OT security strategy aligned with critical-infrastructure expectations (NIST CSF, ICS-CERT, AWIA 2013, CIP standards).

• Develops and enforces third-party risk governance including security assessments, Request for Proposal (RFP) security requirements, contract risk clauses, and ongoing vendor assurance for critical suppliers (cloud, OT, databases, integrators).

• Subscribes to and operationalizes water-sector threat intelligence (CISA water-sector ISAC, EPA alerts, sector-specific ATT&CK). Briefs leadership on emerging threats and mitigation requirements.

• Owns DC Water's compliance posture across AWIA risk-and-resilience (Section 2013), EPA SDWA cybersecurity expectations, PCI-DSS (if payment systems are in scope), and municipal/federal audit requirements.

• Leads comprehensive segregation-of-duties (SOD) remediation across Oracle Fusion ERP and related financial systems. Implements an SOD ruleset covering Procure-to-Pay, Record-to-Report, and ITGC. Collaborates with Finance and Internal Audit to verify closure of related audit findings.

• Coordinates response to external audits (federal oversight, CPA firms) and internal audit programs. Tracks audit findings through closure; maintains evidence and attestation documentation.

• Ensures compliance with privacy expectations (FERPA for school data, general PII safeguards, vendor data-sharing agreements). Establishes data governance policies and stewardship roles.

• Establishes formal dotted-line reporting to the Audit & Risk Committee. Provides quarterly/ad-hoc governance and compliance status reports. Maintains independence in assurance function while supporting the CIO/EVP's operational authority.

• Develops, maintains, and publishes Information Security, Compliance, and Governance policies. Establishes standards for technology risk, vendor risk, data handling, and incident response. Manages policy exceptions and waivers.

• Chairs or co-chairs technology governance forums (e.g., IT Steering Committee, Risk Management Committee, Third-Party Risk Council) to coordinate cross-functional decisions.

• Performs other related duties and projects as assigned at the discretion of the Chief Information Officer and Executive Vice-President.

Supervisory Responsibilities: Directs a group of consultants and employees to ensure the security program and objectives are met.

Key Working Relationships: Interacts with Senior and Executive Level Staff members and employees throughout the Authority and representatives from other utilities and other government organizations and agencies.

Skills & Qualifications:
The qualifications listed below are representative of the knowledge, skill, and ability necessary for an individual to perform each essential responsibility satisfactorily. Reasonable amounts of training are provided.

Required Skills & Qualifications
Required Experience:A minimum of ten (10) years of progressive experience in Information Technology, IT Security, Compliance & Governance, or a related technical field, including at least seven (7) years of management experience.Demonstrated experience leading security, compliance, or governance teams; managing multi-disciplinary staff and external vendor relationships.Direct experience with external audit processes (financial statement audits, regulatory audits, third-party assurance).Working knowledge of multiple compliance frameworks (NIST CSF, CIS Controls, ISO 27001, COBIT, COSO, SOC2).Working knowledge of IT/OT security, SCADA/ICS environments, and critical infrastructure.Familiarity with risk management tools, vulnerability management, and security metrics.Minimum Education Requirements:Bachelor's degree in Information Technology/Information Security Systems or a related technical field or the equivalent combination of education and experience consisting of a High School Diploma or General Educational Development certificate (GED) and a minimum of fourteen (14) years of progressive experience in Information Technology, IT Security, Compliance & Governance, or a related technical field, including at least seven (7) years of management experience.Required Skills: Ability to build trust across IT, Finance, Legal, Operations, and Board stakeholders with competing priorities.Understanding of audit frameworks, regulatory expectations, and how to position the organization for external review.Experience driving cultural and organizational change in security-conscious environments.Required Licenses & Certifications: N/APhysical Requirements: General office conditions. Periodic travel to treatment facilities, pump stations, and field infrastructure for security assessments and incident response.On-call availability for security incidents; participation in 24/7 incident escalation protocols.

Preferred Skills & Qualifications
Preferred Experience:Experience in regulated industries (publicly traded firms, public sector or like).Strong background in large, complex enterprise environments in public or private sector requiring highly regulated governance.Knowledge of industry-specific compliance (AWIA, HIPAA, SOC2, PCI-DSS, CJIS, SOX) preferred.Preferred Education Requirements:N/APreferred Skills:N/A
*The work environment characteristics described in the physical requirements section of the required skills & qualifications table are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential responsibilities.