Virtual Chief Information Security Officer (vCISO) - OT & Cybersecurity Governance

Service Delivery Director

The Virtual Chief Information Security Officer (vCISO) will provide strategic leadership and governance for Cybersecurity and Operational Technology (OT) security program. The role is responsible for establishing and executing the cybersecurity strategy, developing governance frameworks, managing cyber risk, ensuring regulatory and audit compliance, overseeing security policies and controls, driving security awareness, coordinating incident response activities, and providing executive-level reporting to management and Board stakeholders.

The vCISO will act as trusted cybersecurity advisor, ensuring that IT and OT environments remain secure, resilient, compliant, and aligned with business objectives. The role will be particularly focused on securing mining operations, industrial control systems, SCADA environments, critical infrastructure, and enterprise technology platforms.

Develop and maintain Cybersecurity and OT Security Strategy.

Define short-term, medium-term, and long-term security roadmaps.

Align cybersecurity initiatives with business objectives and operational risks.

Advise executive leadership on security priorities, investments, and emerging threats.

Establish cybersecurity governance structures and steering committees.

Develop security controls and governance frameworks for Operational Technology (OT) environments.

Assess and improve security posture across mining operations, industrial networks, SCADA systems, and production environments.

Define network segmentation and security architecture standards between IT and OT environments.

Oversee OT cybersecurity risk management and mitigation programs.

Recommend security controls for critical industrial infrastructure.

Establish enterprise cybersecurity risk management frameworks.

Conduct cyber risk assessments and maturity assessments.

Maintain Cyber Risk Registers and remediation roadmaps.

Identify vulnerabilities, threats, and potential business impacts.

Present risk findings and mitigation plans to executive leadership and governance boards.

Establish cybersecurity policies, standards, procedures, and security baselines.

Define governance controls for identity management, privileged access, endpoint security, network security, cloud security, and OT environments.

Ensure compliance with industry standards and internal security requirements.

Support internal audits, external audits, and regulatory assessments.

Drive closure of audit observations and security findings.

Review and approve security designs for infrastructure and transformation initiatives.

Provide governance over firewalls, VPNs, endpoint protection, identity services, network security, cloud security, and monitoring platforms.

Ensure security-by-design principles are adopted across projects.

Review security exceptions and compensating controls.

Advise on technology investments and cybersecurity improvements.

Establish and maintain Cyber Incident Response and Escalation Procedures.

Provide executive oversight during cybersecurity incidents.

Coordinate investigation, containment, recovery, and post-incident reviews.

Ensure lessons learned and corrective actions are implemented.

Develop cybersecurity resilience, business continuity, and disaster recovery governance programs.

Develop and lead enterprise-wide cybersecurity awareness programs.

Conduct executive security awareness sessions and phishing simulations.

Promote cybersecurity best practices across business and operational teams.

Develop security communications, advisories, and awareness campaigns.

Improve overall security maturity and culture.

Prepare cybersecurity dashboards and executive reports.

Present cybersecurity risks, compliance status, incidents, and strategic initiatives to management and board members.

Define and report cybersecurity KPIs, KRIs, and maturity metrics.

Provide recommendations on risk acceptance, mitigation priorities, and investment planning.

Facilitate periodic Cybersecurity Governance Review meetings.

Assess third-party cybersecurity risks.

Review vendor security controls and compliance requirements.

Participate in contract reviews from a security perspective.

Ensure suppliers and service providers comply with security expectations.

Monitor remediation of third-party security risks.

Cybersecurity Governance

OT/ICS/SCADA Security

Enterprise Security Architecture

Risk Management

Security Compliance & Audits

Incident Response Governance

Business Continuity & Disaster Recovery

Security Awareness & Training

Third-Party Risk Management

Security Program Development

Industrial Control Systems (ICS)

SCADA Security

Network Security

Identity & Access Management (IAM)

Privileged Access Management (PAM)

Endpoint Security

Cloud Security (M365, Azure, AWS)

Vulnerability Management

Security Operations & SIEM

Data Protection & Information Security

15+ years of IT and Cybersecurity experience.

8+ years in Cybersecurity Leadership, Governance, or CISO-level functions.

Demonstrated experience securing OT, SCADA, Industrial, Mining, Utilities, Manufacturing, or Critical Infrastructure environments.

Experience leading audit readiness, risk management, and enterprise security programs.

Experience presenting to Executive Leadership and Board-level stakeholders.

CISSP

CISM

CRISC

CGEIT

ISO 27001 Lead Implementer / Lead Auditor

IEC 62443 (Industrial Cybersecurity)

CCSP or equivalent cloud security certification