Associate Director - Cybersecurity Risk and Compliance

About the role

We are seeking an Associate Director to lead cybersecurity risk and compliance activities across both IT and Operational Technology (OT) environments. The role will drive risk assessments, manage compliance programs, and serve as the primary liaison for internal and external audits and regulatory inspections.

Key responsibilities

• Conduct periodic and ad‑hoc cybersecurity risk assessments for IT and OT assets, including PLCs, HMIs, RTUs, SCADA, DCS and related network infrastructure.
• Identify, document and prioritize OT‑specific risk scenarios such as control system disruption, unauthorized access and safety manipulation.
• Coordinate risk reviews for major system upgrades, new deployments and post‑incident reassessments.
• Maintain and update the cybersecurity risk register, tracking likelihood, impact, treatment plans and ownership.
• Lead internal compliance assessments across all relevant domains and act as the main interface for external audits and regulatory inspections.
• Perform periodic OT compliance assessments, validate configuration baselines (firewall rules, firmware versions) and ensure alignment with applicable standards.
• Manage remediation plans for compliance gaps, audit findings and third‑party risk assessments.
• Define and monitor key risk indicators (KRIs) in partnership with performance management to proactively track exposure.
• Maintain a centralized compliance register mapping regulatory requirements to policies, controls and evidence sources.

Required profile

• Significant experience in cybersecurity risk management and compliance, preferably in industrial or OT‑focused environments.
• Proven ability to lead risk assessment programmes, coordinate audits and drive remediation actions.
• Strong understanding of OT architectures, control systems and associated security standards.
• Excellent communication skills to interact with technical teams, business stakeholders and external regulators.

Required skills

• Cybersecurity risk assessment (IT & OT)
• Operational Technology security (PLC, HMI, RTU, SCADA, DCS)
• Compliance assessment and audit coordination
• Risk register and KRI management
• Configuration baseline validation (firewall rules, firmware versions)
• Third‑party cybersecurity risk evaluation