Director, Security & Compliance - (27-IT-601015-089)

The intent of this job description is to provide a representative summary of the major duties, locations, and responsibilities performed by incumbent(s) in this job. Incumbent(s) may not be required to perform all duties in this description, and incumbent(s) may be required to perform work-related tasks other than those specifically listed in this description. This job description is not a “contract” between the employee and the Authority. The job duties and essential functions may be changed at the discretion of the General Manager.

General Job Title: Director, Security & Compliance Job Code: OA0506 Supervises Directly: Yes New or Revised: New Regular or At-Will: At-Will Date: 10/8/2026 Exempt or Non-Exempt: Exempt Compensation Approval Signature: Union / Non-Union: Non-Union

Division:

Department:

Information Technology

IT - Information Security Salary Schedule: Non-Union Salary Range Cost Center Code: 601015 Grade: ESSB Essential Position: Yes Reports To: Chief Information Officer and Executive Vice-President EEO Code: Officials and Administrators Work Format: Hybrid

Who We Are & What We Do:

At DC Water, we provide more than 700,000 District of Columbia residents and 24.6 million annual visitors with essential water, wastewater, and stormwater services. DC Water also provides wholesale wastewater treatment services for 1.8 million people in Montgomery and Prince George's counties in Maryland, and Fairfax and Loudoun counties in Virginia. We aspire to be known for superior service, ingenuity, and stewardship to advance the health and well-being of our diverse workforce and communities. To achieve this vision, we commit to our shared mission every day—exceeding expectations by providing high quality water services in a safe, environmentally friendly, and efficient manner.

Role Description:

The Director, Security & Compliance leads an integrated program spanning information technology/operational technology (IT/OT) security, cyber risk management, compliance frameworks, internal controls, third-party risk governance, and board-level assurance. This executive role consolidates fragmented security, privacy, compliance, and governance accountabilities under the unified leadership of the Chief Information Officer and Executive Vice-President and maintains independent assurance relationships with the Audit & Risk Committee.

Essential Duties & Responsibilities:

Develops and executes a comprehensive IT/OT security strategy aligned with critical-infrastructure expectations (NIST CSF, ICS-CERT, AWIA 2013, CIP standards).

Develops and enforces third-party risk governance including security assessments, Request for Proposal (RFP) security requirements, contract risk clauses, and ongoing vendor assurance for critical suppliers (cloud, OT, databases, integrators).

Subscribes to and operationalizes water-sector threat intelligence (CISA water-sector ISAC, EPA alerts, sector-specific ATT&CK). Briefs leadership on emerging threats and mitigation requirements.

Owns DC Water's compliance posture across AWIA risk-and-resilience (Section 2013), EPA SDWA cybersecurity expectations, PCI-DSS (if payment systems are in scope), and municipal/federal audit requirements.

Leads comprehensive segregation-of-duties (SOD) remediation across Oracle Fusion ERP and related financial systems. Implements an SOD ruleset covering Procure-to-Pay, Record-to-Report, and ITGC. Collaborates with Finance and Internal Audit to verify closure of related audit findings.

Coordinates response to external audits (federal oversight, CPA firms) and internal audit programs. Tracks audit findings through closure; maintains evidence and attestation documentation.

Ensures compliance with privacy expectations (FERPA for school data, general PII safeguards, vendor data-sharing agreements). Establishes data governance policies and stewardship roles.

Establishes formal dotted-line reporting to the Audit & Risk Committee. Provides quarterly/ad-hoc governance and compliance status reports. Maintains independence in assurance function while supporting the CIO/EVP's operational authority.

Develops, maintains, and publishes Information Security, Compliance, and Governance policies. Establishes standards for technology risk, vendor risk, data handling, and incident response. Manages policy exceptions and waivers.

Chairs or co-chairs technology governance forums (e.g., IT Steering Committee, Risk Management Committee, Third-Party Risk Council) to coordinate cross-functional decisions.

Performs other related duties and projects as assigned at the discretion of the Chief Information Officer and Executive Vice-President.

Supervisory Responsibilities: Directs a group of consultants and employees to ensure the security program and objectives are met.

Key Working Relationships: Interacts with Senior and Executive Level Staff members and employees throughout the Authority and representatives from other utilities and other government organizations and agencies.

Skills & Qualifications:

The qualifications listed below are representative of the knowledge, skill, and ability necessary for an individual to perform each essential responsibility satisfactorily. Reasonable amounts of training are provided.

Required Skills & Qualifications Required Experience: A minimum of ten (10) years of progressive experience in Information Technology, IT Security, Compliance & Governance, or a related technical field, including at least seven (7) years of management experience. Demonstrated experience leading security, compliance, or governance teams; managing multi-disciplinary staff and external vendor relationships. Direct experience with external audit processes (financial statement audits, regulatory audits, third-party assurance). Working knowledge of multiple compliance frameworks (NIST CSF, CIS Controls, ISO 27001, COBIT, COSO, SOC2). Working knowledge of IT/OT security, SCADA/ICS environments, and critical infrastructure. Familiarity with risk management tools, vulnerability management, and security metrics. Minimum Education Requirements: Bachelor’s degree in Information Technology/Information Security Systems or a related technical field or the equivalent combination of education and experience consisting of a High School Diploma or General Educational Development certificate (GED) and a minimum of fourteen (14) years of progressive experience in Information Technology, IT Security, Compliance & Governance, or a related technical field, including at least seven (7) years of management experience. Required Skills: Ability to build trust across IT, Finance, Legal, Operations, and Board stakeholders with competing priorities. Understanding of audit frameworks, regulatory expectations, and how to position the organization for external review. Experience driving cultural and organizational change in security-conscious environments. Required Licenses & Certifications: N/A Physical Requirements: General office conditions. Periodic travel to treatment facilities, pump stations, and field infrastructure for security assessments and incident response. On-call availability for security incidents; participation in 24/7 incident escalation protocols.

Preferred Skills & Qualifications Preferred Experience: Experience in regulated industries (publicly traded firms, public sector or like). Strong background in large, complex enterprise environments in public or private sector requiring highly regulated governance. Knowledge of industry-specific compliance (AWIA, HIPAA, SOC2, PCI-DSS, CJIS, SOX) preferred. Preferred Education Requirements: N/A Preferred Skills: N/A

*The work environment characteristics described in the physical requirements section of the required skills & qualifications table are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential responsibilities.

Your Experience at DC Water :

At DC Water, our people make us an industry leader. Join a group of thinkers, innovators, and problem solvers focused on protecting life’s most precious resource in the nation’s capital.

Take pride in your work. We provide an essential service and do work that matters. A career at DC Water is an exciting opportunity to help improve the environment and make a lasting difference for the community.

Connect to a strong culture. Everything we do is grounded in our shared values—accountability, trust, teamwork, customer focus, safety, and well-being.

Be your true self. We are an inclusive organization that embraces diversity, and we recognize and celebrate employees’ individuality and unique contributions.

Build your skills and career path. We are committed to developing a future-ready workforce by helping our employees develop skills for the jobs of tomorrow.

We are proud to be an EEO/AA employer M/F/D/V.

We maintain a drug-free workplace and perform pre-employment substance abuse testing.

The Americans with Disabilities Act prohibits discrimination against “qualified individuals with disabilities.”

If a reasonable accommodation is needed to participate in the job application or interview process, to

perform essential job functions, and/or to receive other benefits and privileges of employment, please

email complianceada@dcwater.com.