Director of Enterprise Cyber Exposure & CTEM

Bhe Gt&S; Des Moines (IA); Hybrid; USD 179,000 - 223,000; Full time

Job summary

MidAmerican Energy Company seeks a Director of Exposure Management to lead enterprise cyber exposure governance across IT, OT, cloud, and applications. You will drive CTEM, vulnerability management, and external attack surface discovery while partnering with risk, compliance, and leadership to prioritize remediation and ownership.

The role requires ten years of cybersecurity/IT risk experience with leadership, strong communication skills, and a track record of reducing exposure through

Qualifications

• Bachelor’s degree or equivalent experience in IT/security fields.
• At least ten years in cybersecurity or IT risk with leadership experience.
• Experience maturing enterprise vulnerability/CTEM programs in large orgs.

Responsibilities

• Exposure management strategy and governance aligned with business and regulatory goals.
• Lead CTEM and vulnerability management across IT, OT, cloud, and apps.
• Oversee external attack surface discovery and ownership validation.
• Direct security assessments and validation activities with vendors.
• Drive remediation governance with clear ownership, timelines, and metrics.
• Develop executive dashboards and reporting on risk reduction and exposure trends.
• Enable affiliates with consistent standards and governance expectations.
• Lead team development, budgets, and cross-functional coordination.

Skills

Leadership

Risk-based prioritization

CTEM

Vulnerability management

External attack surface management

Security assessments

Remediation governance

Executive communication

Education

Bachelor's degree in IT/CS

Tools

Rapid7

Cortex Xpanse

Horizon3

Microsoft security products

Axonious

Job description

MidAmerican Energy Company seeks a Director of Exposure Management to lead enterprise cyber exposure governance across IT, OT, cloud, and applications. You will drive CTEM, vulnerability management, and external attack surface discovery while partnering with risk, compliance, and leadership to prioritize remediation and ownership.

The role requires ten years of cybersecurity/IT risk experience with leadership, strong communication skills, and a track record of reducing exposure through