About The Role

The Director, Exposure Management leads Berkshire Hathaway Energy's enterprise cybersecurity exposure management program across information technology, operational technology, cloud, applications, software supply chain, and externally accessible environments. Reporting to the Senior Director, Security Governance, Risk & Assurance, this position directs a team of employees and is accountable for executing a risk-based, measurable approach to discovering, prioritizing, assigning ownership, validating, remediating, and governing cyber exposures across Berkshire Hathaway Energy and its affiliates.

The director advances Continuous Threat Exposure Management (CTEM), vulnerability management, external attack surface management, security assessments, application and software supply chain exposure management, offensive security validation, and remediation governance. The role partners with affiliate security teams, technology owners, application and cloud teams, risk and compliance functions, and executive leadership to focus resources on exposures that present the greatest business, operational, regulatory, and safety risk while driving clear ownership, timely remediation, and defensible risk decisions.

Exposure management strategy and governance (20%)

Develop and execute an enterprise exposure management strategy aligned with cybersecurity, business, operational, regulatory, and resilience objectives. Establish governance for exposure discovery, asset ownership, risk-based prioritization, validation, remediation, exception management, and reporting. Define decision criteria that consider threat intelligence, active exploitation, adversary behavior, known exploited vulnerabilities, exploit prediction, asset exposure, business criticality, operational impact, compensating controls, and regulatory obligations.

CTEM and vulnerability management (20%)

Lead the enterprise vulnerability and exposure management lifecycle for servers, endpoints, network infrastructure, applications, code, third-party components, cloud services, and OT environments. Mature CTEM practices across scoping, discovery, prioritization, validation, and mobilization. Ensure scanning coverage, asset inventory accuracy, data quality, ownership mapping, prioritization, remediation timelines, escalation, and risk acceptance processes are consistently defined and monitored.

External attack surface and exposure discovery (10%)

Oversee continuous identification and monitoring of internet-facing assets and services. Establish processes to identify unknown or unauthorized assets, exposed services, insecure configurations, end-of-life technology, and other externally exploitable conditions. Coordinate with responsible teams to validate ownership and reduce unnecessary attack surface.

Security assessments and validation (10%)

Direct independent security assurance activities application and cloud security assessments, automated security validation, and vendor-supported testing. Confirm whether identified exposures are exploitable, validate corrective actions, and use results to improve security controls and program priorities.

Remediation governance and risk reduction (15%)

Partner with technology and business leaders to develop and track remediation plans for material exposures. Establish a remediation operating model with clear intake, triage, owner assignment, due dates, escalation, validation, closure criteria, and exception processes. Separate routine operating system and technology lifecycle patching from vulnerability-driven remediation while maintaining an integrated view of enterprise exposure. Identify recurring conditions and systemic weaknesses, and sponsor sustainable corrective actions that create lasting ownership and remediation accountability.

Metrics, reporting, and executive communication (10%)

Develop executive-level scorecards, dashboards, and narratives that emphasize measurable risk reduction, exposure reduction, remediation effectiveness, aged exposure reduction, service-level performance, attack surface reduction, asset coverage, ownership quality, validation pass rates, and risk exception trends rather than vulnerability volume alone. Communicate significant exposures, trends, constraints, and decisions to leadership and governance forums.

Affiliate enablement and enterprise consistency (5%)

Establish common exposure management standards, processes, metrics, and governance expectations across Berkshire Hathaway Energy while enabling affiliate-specific execution based on technology environment, operational constraints, regulatory obligations, and business risk. Promote consistent ownership, prioritization, exception handling, and executive reporting while recognizing differences across affiliate operating models.

Leadership, change management, and administration (10%)

Select, coach, develop, and evaluate team members. Set priorities, establish performance expectations, support succession and career development, and foster effective teamwork and high personal integrity. Lead organizational change by helping affiliates and technology teams transition from volume-based vulnerability management to risk-based exposure reduction with clear accountability and measurable outcomes. Manage budgets, vendors, managed services, and contracted assessment resources. Perform additional responsibilities as requested or assigned.

Bachelor's degree in cybersecurity, information technology, computer science, engineering, business, or a related field from an accredited institution, or equivalent related work experience. (Typically, four years of additional related, progressive work experience would be needed for candidates who do not possess a bachelor's degree).

A minimum of ten years of progressive cybersecurity, information technology risk, vulnerability management, security assessment, or related experience, including at least five years leading cybersecurity programs, technical teams, or people.

Demonstrated experience building, leading, or materially maturing an enterprise vulnerability management, threat exposure management, CTEM, attack surface management, offensive security, application security, software supply chain security, or security assurance program in a large or complex organization.

Strong knowledge of risk-based vulnerability prioritization, threat intelligence, exploitability analysis, remediation governance, exception management, vulnerability lifecycle processes, external attack surface management, penetration testing, red teaming, application security testing, software composition analysis, cloud security posture, and security control validation.

Knowledge of IT and OT/ICS technology environments, including networks, operating systems, endpoints, applications, cloud services, industrial control systems, and internet-facing infrastructure.

Working knowledge of recognized cybersecurity and control frameworks such as the NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, and ISO/IEC 27001. Knowledge of electric utility or critical infrastructure regulatory requirements is preferred.

Experience with enterprise security platforms and data sources used for vulnerability scanning, external attack surface management, application security testing, cloud posture management, OT security monitoring, threat intelligence, workflow management, and executive reporting. Experience with tools such as Rapid7, Cortex Xpanse, Horizon3, Microsoft security products, and Axonious is beneficial but not required.

Ability to translate technical findings into business risk, establish practical priorities, assign accountability, challenge assumptions constructively, and drive coordinated action across organizational boundaries without relying solely on direct authority.

Excellent oral and written communication skills, including executive and board-level presentation skills. Effective interpersonal, customer relationship, analytical, problem-solving, negotiation, and decision-making skills.

Strong program and project management skills, including the ability to prioritize and manage multiple complex initiatives concurrently.

Professional certifications such as CISSP, CISM, CRISC, GIAC, or similar credentials are preferred.