Director, Security & Compliance - (27-IT-601015-089)

The intent of this job description is to provide a representative summary of the major duties, locations, and responsibilities performed by incumbent(s) in this job. Incumbent(s) may not be required to perform all duties in this description, and incumbent(s) may be required to perform work-related tasks other than those specifically listed in this description. This job description is not a “contract” between the employee and the Authority. The job duties and essential functions may be changed at the discretion of the General Manager. 

Information Technology

IT - Information Security

At DC Water, we provide more than 700,000 District of Columbia residents and 24.6 million annual visitors with essential water, wastewater, and stormwater services. DC Water also provides wholesale wastewater treatment services for 1.8 million people in Montgomery and Prince George's counties in Maryland, and Fairfax and Loudoun counties in Virginia. We aspire to be known for superior service, ingenuity, and stewardship to advance the health and well-being of our diverse workforce and communities. To achieve this vision, we commit to our shared mission every day—exceeding expectations by providing high quality water services in a safe, environmentally friendly, and efficient manner.

The Director, Security & Compliance leads an integrated program spanning information technology/operational technology (IT/OT) security, cyber risk management, compliance frameworks, internal controls, third-party risk governance, and board-level assurance. This executive role consolidates fragmented security, privacy, compliance, and governance accountabilities under the unified leadership of the Chief Information Officer and Executive Vice-President and maintains independent assurance relationships with the Audit & Risk Committee.

• Develops and executes a comprehensive IT/OT security strategy aligned with critical-infrastructure expectations (NIST CSF, ICS-CERT, AWIA 2013, CIP standards).

• Develops and enforces third-party risk governance including security assessments, Request for Proposal (RFP) security requirements, contract risk clauses, and ongoing vendor assurance for critical suppliers (cloud, OT, databases, integrators).

• Subscribes to and operationalizes water-sector threat intelligence (CISA water-sector ISAC, EPA alerts, sector-specific ATT&CK). Briefs leadership on emerging threats and mitigation requirements.

• Owns DC Water's compliance posture across AWIA risk-and-resilience (Section 2013), EPA SDWA cybersecurity expectations, PCI-DSS (if payment systems are in scope), and municipal/federal audit requirements.

• Leads comprehensive segregation-of-duties (SOD) remediation across Oracle Fusion ERP and related financial systems. Implements an SOD ruleset covering Procure-to-Pay, Record-to-Report, and ITGC. Collaborates with Finance and Internal Audit to verify closure of related audit findings.

• Coordinates response to external audits (federal oversight, CPA firms) and internal audit programs. Tracks audit findings through closure; maintains evidence and attestation documentation.

• Ensures compliance with privacy expectations (FERPA for school data, general PII safeguards, vendor data-sharing agreements). Establishes data governance policies and stewardship roles.

• Establishes formal dotted-line reporting to the Audit & Risk Committee. Provides quarterly/ad-hoc governance and compliance status reports. Maintains independence in assurance function while supporting the CIO/EVP's operational authority.

• Develops, maintains, and publishes Information Security, Compliance, and Governance policies. Establishes standards for technology risk, vendor risk, data handling, and incident response. Manages policy exceptions and waivers.

• Chairs or co-chairs technology governance forums (e.g., IT Steering Committee, Risk Management Committee, Third-Party Risk Council) to coordinate cross-functional decisions.

• Performs other related duties and projects as assigned at the discretion of the Chief Information Officer and Executive Vice-President.

*The work environment characteristics described in the physical requirements section of the required skills & qualifications table are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential responsibilities. 

At DC Water, our people make us an industry leader. Join a group of thinkers, innovators, and problem solvers focused on protecting life’s most precious resource in the nation’s capital.

• Take pride in your work. We provide an essential service and do work that matters. A career at DC Water is an exciting opportunity to help improve the environment and make a lasting difference for the community.

• Connect to a strong culture. Everything we do is grounded in our shared values—accountability, trust, teamwork, customer focus, safety, and well-being.

• Be your true self. We are an inclusive organization that embraces diversity, and we recognize and celebrate employees’ individuality and unique contributions.

• Build your skills and career path. We are committed to developing a future-ready workforce by helping our employees develop skills for the jobs of tomorrow.

We are proud to be an EEO/AA employer M/F/D/V.

We maintain a drug-free workplace and perform pre-employment substance abuse testing.

The Americans with Disabilities Act prohibits discrimination against “qualified individuals with disabilities.”

If a reasonable accommodation is needed to participate in the job application or interview process, to

perform essential job functions, and/or to receive other benefits and privileges of employment, please

email complianceada@dcwater.com.