Director, OT Operations, Cybersecurity, and Governance

Overview

Cypress Creek is seeking a Director, OT Operations, Governance, and Cybersecurity to lead the strategy, delivery, and continuous improvement of the operational technology services that monitor and control our generation sites. This leader will be accountable for reliable OT operations, a consistent governance framework, adherence to NERC Regulatory Standards, and a risk-based cybersecurity program across SCADA and supporting infrastructure. The Director will establish priorities, lead technical teams and service providers, manage budgets and technology roadmaps, and partner with operations, engineering, IT, cybersecurity, and compliance to protect personnel, maintain availability, and support fleet growth without compromising safe operations.

Responsibilities

• Define and execute a multiyear OT strategy and roadmap aligned with fleet growth, operational priorities, cybersecurity risk, and business objectives.
• Establish the OT operating model, service ownership, decision rights, accountability, and performance expectations across internal teams and service providers.
• Lead, mentor, and develop multidisciplinary OT operations, engineering, governance, and cybersecurity personnel.
• Develop annual operating and capital budgets, business cases, staffing plans, and investment priorities for OT services and infrastructure.
• Prioritize initiatives using risk, reliability, lifecycle condition, regulatory obligations, cost, and business value.
• Provide executive-level reporting on OT strategy, financial performance, resource needs, material risks, and delivery milestones.

OT Cybersecurity Program Owner

• Own the OT cybersecurity program, control framework, roadmap, and risk-based priorities across generation sites and supporting infrastructure.
• Direct asset inventory, network segmentation, vulnerability management, secure configuration, patching, endpoint protection, and security monitoring practices.
• Establish requirements for identity, privileged access, multifactor authentication, vendor remote access, removable media, and transient cyber assets.
• Lead OT cyber incident preparedness, response, escalation, communications, lessons learned, and corrective-action tracking.
• Coordinate threat intelligence, detection engineering, security monitoring, and response workflows with enterprise cybersecurity and site operations.
• Measure and communicate cybersecurity maturity, control effectiveness, exposure trends, remediation progress, and residual risk.

Regulatory Compliance

• Provide leadership and oversight for applicable regulatory obligations, including NERC CIP and O&P requirements and internal compliance commitments.
• Translate regulatory requirements into sustainable OT procedures, controls, evidence standards, ownership assignments, and operating routines.
• Maintain audit-ready documentation and evidence for access, configuration, patching, vulnerability, incident, recovery, and change-management controls.
• Partner with legal, compliance, operations, engineering, and cybersecurity teams to assess applicability and address control gaps.
• Lead readiness assessments, internal reviews, regulator or auditor engagement, evidence requests, and remediation planning.
• Track regulatory changes and update policies, standards, training, and technical controls within required time frames.

OT Risk and Compliance Leader

• Establish and maintain an OT risk-management framework, risk register, control library, exception process, and accountable risk owners.
• Facilitate risk assessments for sites, systems, projects, vendors, architecture changes, acquisitions, and emerging threats.
• Evaluate risk in the context of personnel safety, reliable operations, generation availability, cybersecurity, regulatory exposure, and financial impact.
• Define remediation plans, compensating controls, target dates, escalation criteria, and formal risk-acceptance requirements.
• Align OT governance with recognized practices such as NIST CSF and NIST SP 800-82 while tailoring controls to operational realities.
• Report material risk, overdue remediation, policy exceptions, control deficiencies, and trends to appropriate governance forums.

OT Strategy, leadership, and financial stewardship

• Direct reliable day-to-day delivery of SCADA, control systems, OT networks, servers, workstations, historians, communications, and supporting services.
• Establish service levels, operational procedures, on-call coverage, escalation paths, maintenance windows, and incident and problem-management practices.
• Govern change, configuration, release, capacity, availability, and lifecycle-management processes for production OT environments.
• Sponsor resilient architecture, tested backups, disaster recovery, continuity plans, redundancy, and restoration exercises.
• Coordinate commissioning, operational acceptance, documentation, support transition, and standardization for new or acquired assets.
• Drive root-cause analysis, corrective actions, technical-debt reduction, automation, and continuous improvement of OT services.

OT Vendor and Third-Party Governance Owner

• Define security, service, documentation, support, resilience, notification, and access requirements for OT vendors and service providers.
• Lead technical due diligence, cybersecurity assessments, product selection, contract input, and onboarding for third parties and managed services.
• Govern vendor identities, privileged access, remote connectivity, session oversight, approval workflows, and timely access removal.
• Monitor service levels, control performance, vulnerabilities, end-of-life exposure, support quality, costs, and corrective actions.
• Ensure contracts address incident reporting, breach notification, evidence support, data handling, business continuity, and exit obligations.
• Maintain strategic supplier relationships and escalate material performance, cybersecurity, compliance, or delivery concerns.

OT Cross-Functional Business Partner

• Partner with operations, engineering, asset management, IT, enterprise cybersecurity, compliance, legal, procurement, finance, and project delivery teams.
• Translate operational needs and technical risks into clear priorities, investment decisions, delivery plans, and executive recommendations.
• Align enterprise technology and security services with OT availability, safety, latency, supportability, and site-access requirements.
• Support project design reviews, architecture decisions, commissioning, acquisitions, integrations, and operational handoffs.
• Facilitate governance forums that resolve competing priorities, approve exceptions, assign accountability, and remove delivery barriers.
• Promote shared ownership of OT reliability, cybersecurity, compliance, lifecycle planning, and continuous improvement across the organization.

OT Performance and Assurance

• Define key performance, risk, control, service, reliability, recovery, financial, and delivery indicators for the OT function.
• Establish dashboards and reporting cadences that provide timely, accurate, and actionable visibility to operational and executive stakeholders.
• Monitor service availability, incidents, vulnerabilities, patch status, backup success, recovery testing, lifecycle exposure, and remediation performance.
• Conduct control testing, service reviews, maturity assessments, post-incident reviews, and independent assurance activities as appropriate.
• Validate that corrective actions are evidence-based, sustainably implemented, assigned to accountable owners, and completed on schedule.
• Use performance and risk trends to drive investment decisions, resource allocation, process improvement, and roadmap adjustments.

Education & Experience Required

• Advanced technical degree in fields such as engineering, computer science, information systems, or a related technical field.
• 10+ years of relevant experience, including 5+ years of leadership; in OT operations, ICS/SCADA, industrial cybersecurity, or critical infrastructure technology.
• Demonstrated experience leading technical teams, managing vendors and budgets, and delivering multiyear operational or Cybersecurity programs across distributed facilities.
• Experience overseeing technical and regulatory teams and programs, along with elevating program maturity.
• Proven success in implementing and maintaining regulatory compliance programs.
• Knowledgeable of NERC processes and ability to oversee audits and data requests.
• Experience establishing governance, risk management, change control, compliance evidence, and tested business continuity and disaster recovery processes.
• Ability to translate technical and operational risks into executive decisions, build cross-functional alignment, and balance Cybersecurity, reliability, cost, and business priorities.
• Embrace and live by the mission and values of Cypress Creek Energy

Preferred Qualifications

• Leadership experience supporting ICS/SCADA or OT environments in solar, storage, wind, utilities, or other distributed energy infrastructure.
• Experience leading NERC CIP and O&P compliance support, evidence readiness, and audit remediation
• Familiarity with NIST 800-82 and NIST CSF.
• Experience selecting and governing the tools listed below or comparable products, including vendor evaluation, service integration, and lifecycle planning.
• Relevant certifications such as CISSP, CISM, CRISC, GICSP, or CEH.

Location: The position is remote, with travel up to 25%.

Benefits

• 15 days of Paid Time Off, accrual up to 20 days, 11 observed holidays.
• 401(k) Match
• Comprehensive package including medical, dental, vision and health insurance
• Wellness stipend, family planning stipend, and generous parental leave
• Tuition Reimbursement
• Phone Bill Reimbursement
• Company Swag

A note to Recruiting Agencies Cypress Creek Energy Human Resources team does not accept unsolicited resumes from third party recruiters, staffing firms, or related agencies. The Human Resources team coordinates all recruiting and hiring at our company. We do not accept resumes from third-party recruiters unless authorized by the Human Resources team and if a signed agreement is in place. Any unsolicited resumes will be considered property of CCE and we are not responsible for any related fees. All communication related to recruiting partnerships should ONLY be directed to the Human Resources team.

Cypress Creek Energy is an equal opportunity employer and considers all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or veteran status. We are committed to providing a workplace that is inclusive and values diversity, and we encourage candidates from all backgrounds to apply.

Please be aware of recruiting scams-official communications will only come from @ccrenew.com, we will never request personal or financial information, and any suspicious activity should be reported to [email protected].