Senior Director, Information Security

The Senior Director, Information Security provides strategic leadership and direction for JEA's enterprise information security program. Reporting to the Chief Information Officer (CIO), this role is responsible for establishing and advancing the organization's security strategy, governance, and risk management framework and practices. The Senior Director ensures alignment of security initiatives with JEA’s technology roadmap and business objectives while overseeing the effective execution of security operations. This role serves as the CIO’s key advisor on matters of information security risk, resilience, and regulatory compliance, including NERC CIP, PCI, FACTA, and other regulatory frameworks.

- Oversees the information security environment, implementing standards-based programs, developing policies and guidelines, assessing information technology controls, and leading associated initiatives.

- Advises the CIO and other senior JEA leaders on cyber risks, regulatory obligations, emerging technologies, and security investments.

- Provides strategic leadership in defining and executing a continuous improvement roadmap for the security program, using key performance indicators and reporting to optimize effectiveness and drive results.

- Reports to JEA Board of Directors and senior management on information security program performance, including awareness initiatives, incidents, and advancing information security trends.

- Stays abreast of information security issues and trends, emerging security solutions, and regulatory changes, ensuring alignment with organizational objectives.

- Leads the development and execution and advancement of JEA's enterprise information security program, including policies, standards, governance, and regulatory requirements.

- Oversees incident response, threat detection, and risk mitigation activities across IT and integrated OT environments, ensuring effective coordination and reporting.

- Ensures compliance with applicable standards and regulations (e.g., NERC CIP, FERC, HIPAA, etc.) and leads IT Security response for regulatory activities including root cause analysis and mitigation plan development.

- Provides senior leadership with regular, strategic updates on the organization's security posture, incidents, trends, and program maturity.

- Collaborate with internal stakeholders (e.g., audit, compliance, legal, etc.) to assess risk, implement controls, and strengthen enterprise risk management practices.

- Provides strategic oversight of vendor and third-party risk assessments, ensuring secure and compliant external partnerships.

- Conducts, supports, and/or directs security awareness initiatives, including phishing and social engineering simulations, fostering a proactive culture of accountability.

- Manages security-related budgets and resources, advancing staff development, and performance.

- Develops business cases including cost benefit analysis and Requests for Proposal (RFP) to support related technologies, initiatives, and programs.

- Provides leadership and example in meeting JEA's safety and wellness goals.

- Performs other job-related duties as assigned.

Education

: Bachelor's degree in Information Security, Computer Science, Engineering, or related technical discipline. Master's preferred.

AND

Experience

: Ten (10) years of progressive experience in information security or IT risk management, including at least five (5) years in a leadership role with staff management responsibilities.

OR

An equivalent combination of education, experience, and/or training.

License/Certifications/Registrations

:

Required:

- Valid driver's license (must be maintained during employment)

Preferred (or obtained within agreed timeframe):

- ISACA CISM (Certified Information Security Manager)

- ISACA CRISC (Certified Risk and Information Systems Control)

- ISC2 CISSP (Certified Information System Security Professional)

The salary range for this position is at minimum $225,000 to a midpoint of $337,500 annually. Total compensation is commensurate with education, licenses, certifications, skills, and experience.*