OverviewThe Director, Enterprise Security, leads REC’s enterprise physical and protective security program. The Director establishes risk-based strategy, standards, and controls to protect employees, members and visitors, facilities, substations, and other electric assets, operations, executives and directors, physical information assets, and REC’s reputation. The position leads threat, risk, and vulnerability assessment; security technology and guarding; workplace violence and threat management support; investigations; incident response; protective intelligence and executive protection; security training; and continuous improvement. The Director works closely with Operations, IT/OT Security, Emergency Management, Safety, Human Resources, Legal, Facilities, Communications, Compliance, and law-enforcement and emergency-response partners to support reliable electric service and organizational resilience.
Role and Reporting Primary purpose: Lead REC’s enterprise physical security and protective security program so people, facilities, electric assets, operations, and reputation are protected through risk-based governance, prevention, detection, response, recovery, and continuous improvement.
Reporting: Report to a senior executive with enterprise authority (for example, COO, General Counsel/Chief Risk Officer, or CEO-designated executive), with direct and unfiltered access to the CEO during significant threats and periodic reporting to an executive risk or audit committee.
Boundary: Own physical security; jointly govern cyber-physical risk with IT/OT security; support the enterprise emergency-management program; and manage executive protection using documented, threat-based criteria.
Essential Duties and Responsibilities Strategy, governance, and reporting: Develop and maintain a multi-year enterprise security strategy, annual work plan, policies, standards, site-classification methodology, risk register, budget, and performance dashboard aligned with REC’s mission, risk tolerance, and reliable electric service. Brief executive leadership and the Board or designated committee on material risks, incidents, trends, investments, and corrective actions.
Risk assessment and mitigation: Direct documented threat, risk, and vulnerability assessments for offices, service centers, substations, warehouses, control/communications sites, public events, and other critical locations. Prioritize mitigation using consequence, likelihood, operational dependency, and cost.
Layered physical protection: Set and assure standards for deterrence, detection, delay, response, and recovery, including perimeter protection, locks/keys, access control, visitor and vendor management, video surveillance, alarms, intrusion detection, lighting, communications, and response procedures.
Security technology and lifecycle: Own business requirements, governance, maintenance, testing, integration, cyber coordination, records/privacy controls, replacement planning, and vendor performance for physical-security systems. Participate in design review for new construction and major modifications.
Security operations and contractors: Lead employees and contracted security resources; establish post orders, service levels, training, supervision, escalation, quality assurance, and performance measures. Ensure procurement and contractor decisions reflect risk and value.
Incident management and investigations: Lead or coordinate response to security incidents; establish notification and escalation criteria; conduct or oversee fair, lawful investigations; preserve evidence; coordinate with HR, Legal, IT/OT, Safety and law enforcement; issue after-action findings; and track corrective actions to closure.
Threat management and protective intelligence: Co-lead a multidisciplinary workplace-violence and behavioral-threat process with HR and Legal. Monitor credible threats affecting REC, its people and operations; establish intake, assessment, case management, privacy, referral, and intervention protocols.
Executive and Board protection: Manage a scalable, intelligence-led protection program for executives and directors. Conduct event, venue, route and travel risk assessments as warranted; coordinate with hosts, venues, law enforcement and qualified providers; and recommend coverage proportionate to threat and exposure.
Emergency preparedness and resilience: Serve in the assigned Incident Command System role; integrate security into emergency, storm-restoration, continuity and crisis plans; plan and evaluate drills and exercises; document lessons learned; and support continuity of critical security services.
Cyber-physical coordination: Partner with IT/OT Security and Operations on network-connected security systems, facility/OT access, remote vendor access, identity lifecycle, logging, cyber-physical incidents, and applicable critical-infrastructure standards. Maintain clear accountability boundaries.
External and industry coordination: Maintain effective relationships with federal, state and local law enforcement, emergency management, first responders, neighboring utilities, industry security organizations, and information-sharing partners. Coordinate reports and requests through authorized REC channels.
Training and culture: Develop role-based security awareness, workplace violence reporting, de-escalation, incident reporting, executive/event security, and emergency response training. Conduct exercises and measure learning and program adoption.
Compliance and continuous improvement: Maintain assigned records and evidence; monitor applicable laws, regulations, standards and leading practices; support audits and reviews; assess program effectiveness; and implement risk-based improvements.
Required Skills and Core Competencies • Enterprise risk and security-program leadership,
• Critical-infrastructure and electric-utility awareness,
• Threat, risk, and vulnerability assessment,
• Physical-security technology and layered protection,
• Incident command, crisis judgment, and investigations,
• People leadership, contractor governance, and financial stewardship,
• Executive presence, discretion, and Board-level communication,
• Cross-functional influence, change management, and cooperative/member orientation,
• Ethics, confidentiality, fairness, and sound documentation
Qualifications and Education RequirementsA bachelor’s degree in a relevant field or an equivalent combination of education and directly relevant experience is required. Candidates must have ten years of progressively responsible experience in security, critical infrastructure, emergency management, military, intelligence, or law enforcement, including five years leading personnel, contractors, programs, and budgets. Demonstrated experience with multi-site risk assessments, security systems, incident management, investigations, policy development, training, and executive communication is required.
Candidates must possess a valid driver’s license, satisfy REC driving requirements, and be a United States citizen. Candidates must be able to obtain and maintain the Virginia Department of Criminal Justice Services (DCJS) registration applicable to their assigned duties and, when applicable, DCJS compliance agent certification, including completing required background checks, training, and renewals. Candidates must also be able to complete and maintain firearms training and qualification and obtain the DCJS firearms endorsement for any assigned armed duties, including applicable personal protection duties. Compliance with REC authorization, safe handling, and annual requalification requirements is required. Energy, utility, and cooperative experience; a recognized security or continuity certification; and Incident Command System (ICS) and National Incident Management System (NIMS) training appropriate to assigned duties are preferred.
The position participates in an established on-call and incident-response structure and may require work outside normal hours during emergencies, storms, significant events, or credible threats. Regular travel is required to REC facilities and remote electric sites, where terrain, weather, noise, electrical hazards, and other field conditions may be present. The incumbent must comply with site-access, personal protective equipment (PPE), driving, safety, confidentiality, and fitness-for-duty requirements.
Physical and functional demands may include occasionally lifting, carrying, pushing, or pulling equipment and supplies weighing up to 50 pounds, using approved assistance or equipment when appropriate. The incumbent may be required to walk and stand for extended periods during site inspections and incident response, including on uneven ground, gravel, stairs, and outdoor utility sites. Duties may also require climbing stairs; bending, stooping, kneeling, crouching, reaching, and maintaining balance to inspect security conditions and access equipment or field locations.
The incumbent may be required to operate a motor vehicle, security equipment, computers, radios, and communications devices and use hands for keys, controls, writing, and equipment handling. Duties may require observing and assessing conditions through visual and auditory information, communicating clearly in person and by radio or telephone, and responding promptly to alarms and incidents, with appropriate aids or accommodations. Outdoor work in varying weather and lighting conditions may be required, along with wearing required PPE and following site safety rules. The frequency and precise requirements of these functions should be confirmed through REC’s job analysis.
HOW TO APPLY Hiring Range: $153,166 to $179,970
Deadline: Open Until Filled*The above statements are intended to describe the general nature and level of work being performed by people assigned to this classification. They are not intended to be construed as a complete list of all responsibilities, duties, and skills required of personnel so classified.
Powered by JazzHR