Director of IT Security

Overview

ETAP empowers customers to make informed decisions throughout the lifecycle of their projects with innovative software solutions for electrical systems. By applying ETAP solutions, customers experience continuous intelligence during design, engineering, operations, and maintenance using a unified electrical digital twin platform. ETAP supports customers in their digital transformation and sustainable energy transitions for a green and smart future, helping them prioritize safety, maximize reliability, and stay resilient. ETAP is an Equal Opportunity Employer.

Position Summary

The Director of IT Security serves as the company’s security hub and “quarterback”—aligning IT, Engineering/R&D, Quality, Legal, and business leadership around a clear security strategy, and coordinating end‑to‑end delivery across teams that may not sit within a dedicated security organization. The role drives prioritization, establishes clear ownership, and coordinates end‑to‑end security operations, keeping execution moving (risk management, incidents, audits, vendor/security reviews, and training), and provides timely visibility to leadership on posture, gaps, and remediation progress. The Director owns and coordinates security obligations tied to the National Security Agreement and related federal/customer requirements, ensuring audit readiness, documentation, and evidence management while maintaining operational efficiency.

Key Outcomes

• A practical security program that scales with clear priorities, minimal bureaucracy, and measurable risk reduction.
• Audit‑ and customer‑ready security posture (evidence organized, controls operating, owners assigned).
• Cross‑functional security ownership: security responsibilities embedded across IT, Engineering, and business teams rather than centralized in a large security staff.
• Reliable incident response, monitoring, and reporting pathways that work with limited tools and people.
• Sustained compliance with NSA obligations and related security plans with predictable cadence and governance.

Key Responsibilities

1. Security Leadership and Governance: establish and maintain the company’s security strategy, annual roadmap, and control framework aligned to business priorities and resource constraints; lead a lightweight security governance cadence, define standards, patterns, and guardrails; own security policies, exceptions, and compensating controls.
2. Risk Management: maintain an enterprise risk register; provide security architecture direction for cloud, endpoints, identity, networks, and corporate applications; partner with R&D to implement scalable controls.
3. Cross‑Functional Partnership: collaborate with Engineering/R&D on secure development practices; partner with QA/Quality and Legal on certifications, findings, and contractual obligations; influence leaders to embed security responsibilities into roles and objectives; align strategy with parent and sister company security teams.
4. Compliance, Audit Readiness & Evidence Management: lead planning for internal, customer, third‑party, parent‑company, and government‑related audits; support ISO 27001 and other applicable certifications; maintain an evidence program with procedures, test results, access reviews, training completion, incident records, and corrective actions.
5. National Security Agreement (NSA) & Federal/Controlled Data Responsibilities: define sustainable security controls required by the NSA; protect classified, controlled unclassified information (CUI), export‑controlled, and NSA‑governed data; maintain alignment with NIST, ISO, GDPR, and related frameworks; support FOCI mitigation requirements.
6. Incident Response, Monitoring & Business Continuity: own and run incident response planning and execution; coordinate NSA/customer notifications; ensure pragmatic monitoring and logging coverage; partner with business functions on continuity and disaster recovery planning.
7. Third‑Party/Vendor Security: build a right‑sized vendor risk management program; assess risk, review contracts, and track remediation; ensure critical vendors meet baseline security requirements.
8. Security Awareness & Training: deliver role‑based security training; build a culture of “secure‑by‑default” behaviors through concise guidance and recurring communications.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Information Systems, or equivalent experience.
• 10+ years in information security/IT risk roles with at least 5 years leading security programs or teams.
• Demonstrated experience leading audits and compliance readiness (internal/external/customer).
• Strong ability to translate security requirements into practical controls in a resource‑constrained environment.
• Proven executive communication skills: clear risk narratives and recommendations.
• Preferred experience with NSA environments, FOCI mitigation, or government‑regulated security programs.
• Familiarity with NIST Cybersecurity Framework 2.0, RMF concepts, and secure controlled environment practices.
• Experience supporting product development/engineering environments and CI/CD ecosystems.
• Preferred certifications: CISSP, CISM, CISA, CRISC, or similar.

Core Competencies

• Risk‑based prioritization in resource‑constrained environments.
• Cross‑functional governance and stakeholder management.
• Audit readiness and evidence‑driven compliance.
• Incident leadership and decision‑making under pressure.
• Clear writing: policies, procedures, control narratives, and plans.
• Integrity, discretion, and national security awareness.

Salary Range

$137,500 – $229,500 Annual

Background Checks

ETAP requires all successful applicants to undergo and pass a comprehensive background check before employment. Checks will be conducted in accordance with local laws and may include proof of educational attainment, employment history verification, proof of work authorization, criminal records, identity verification, and credit check. Certain positions dealing with sensitive and/or third‑party personal data may involve additional background check criteria.

Equal Opportunity Employer Statement

ETAP is an Equal Opportunity Employer. We are committed to being an exemplary employer with an inclusive culture, developing a workplace environment where all our employees are treated with dignity and respect. We value diversity and the expertise that people from different backgrounds bring to our business.