Head of Enterprise Cybersecurity & Risk

Octa, LLC; Orange, Northern (CA, KY); Hybrid; USD 173,000 - 238,000; Full time

Job summary

OCTA seeks an executive to lead its Enterprise Cybersecurity program, directing governance, risk management, and incident response across on-premises and cloud environments. The role advises the CIO and Board, shaping a multi-year cybersecurity roadmap and ensuring resilient, compliant operations for Orange County’s critical infrastructure.

You will drive policy, people development, and secure-by-design practices while coordinating with transportation agencies and regulators to strengthen cyber

Qualifications

• Minimum of eight years of related cybersecurity experience in business environments, including at least four years in a cybersecurity management position.
• Hands-on experience with network security services and technologies.
• Demonstrated experience leading enterprise cybersecurity governance, risk management, security operations, and incident response.
• Strong understanding of risks affecting cloud, enterprise infrastructure, identity, operational technology, transportation systems, and critical infrastructure.
• Experience developing cybersecurity strategies, policies, standards, performance measures, and multi-year roadmaps.
• Knowledge of data privacy, data classification, information protection, and data loss prevention principles.
• Knowledge of cybersecurity considerations associated with artificial intelligence, cloud services, emerging technologies, and third-party/supply-chain risk.
• Demonstrated ability to lead significant cybersecurity incidents balancing containment, service continuity, and regulatory requirements.
• Strong business and risk-management judgment with the ability to translate complex cybersecurity issues for executive audiences.
• Proven ability to build partnerships with technology operations, business leaders, regulators, vendors, and external stakeholders.

Responsibilities

• Establish and lead OCTA’s enterprise cybersecurity strategy, governance framework, policies, standards, performance objectives, and multi-year roadmap.
• Direct cybersecurity risk management across cloud/on-prem environments, enterprise networks, IAM, OT, and critical infrastructure.
• Advise executive leadership and Board on cybersecurity posture, risks, incidents, and investment priorities.
• Lead incident readiness and response, including command, communications, coordination, and after-action reviews.
• Establish risk-based vulnerability management, privileged-access, least- privilege, network segmentation, and monitoring practices.
• Lead Data Privacy and Data Classification Program, including sensitive-data discovery and protection.
• Establish governance for AI and emerging technologies with safeguards and oversight.
• Direct third-party and supply-chain cybersecurity risk management and vendor due diligence.
• Promote secure-by-design practices across projects, procurements, cloud modernization, and SDLC.
• Partner with IS Operations and business leaders to develop practical, risk-informed security solutions.
• Analyze threat intelligence, security events, vulnerabilities, audit findings, and third-party risks to identify actions.
• Lead security awareness and role-based training programs with measurable compliance.
• Coordinate cybersecurity audits and remediation actions to closure.
• Develop and lead cybersecurity workforce through mentoring and knowledge transfer.

Skills

Governance & risk management

Incident response leadership

Security operations

Vulnerability management

Identity and access security

Network security

Data privacy & protection

Cloud security awareness

Third-party risk management

Security awareness training

Education

Bachelor's degree or equivalent in CS/Math/Business

Job description

OCTA seeks an executive to lead its Enterprise Cybersecurity program, directing governance, risk management, and incident response across on-premises and cloud environments. The role advises the CIO and Board, shaping a multi-year cybersecurity roadmap and ensuring resilient, compliant operations for Orange County’s critical infrastructure.

You will drive policy, people development, and secure-by-design practices while coordinating with transportation agencies and regulators to strengthen cyber