Department Manager, Cyber Security

Department Manager – Enterprise Cybersecurity

Under the direction of the Chief Information Officer, the Department Manager – Enterprise Cybersecurity establishes, directs, and advances OCTA's enterprise cybersecurity program, protecting information, technology, transportation operations, and critical infrastructure from evolving cyber risks.

As OCTA's senior cybersecurity leader, this position provides strategic direction for cybersecurity governance and risk management, security operations and incident response, data privacy and classification, and the secure adoption of cloud, artificial intelligence, operational, and emerging technologies. The role advises executive leadership on cybersecurity posture, material risks, resilience, regulatory obligations, significant incidents, and strategic investment priorities while building a mature, risk-based cybersecurity program that enables OCTA's business and public-service objectives.

This is an exempt position in Salary Grade 260:
Min – $ | Mid – $ | Max – $/year. The starting salary and level will be within this range based on qualifications.

This posting will remain open until a candidate is selected.

What You'll Do

• Establish and lead OCTA's enterprise cybersecurity strategy, governance framework, policies, standards, performance objectives, and multi-year cybersecurity roadmap
• Direct cybersecurity risk management across cloud and on-premises environments, enterprise networks, identity and access management, operational and transportation technologies, and critical infrastructure
• Advise the CIO, executive leadership, and, as appropriate, the Board of Directors on cybersecurity posture, material risks, significant incidents, program maturity, remediation efforts, and investment priorities
• Lead cybersecurity incident readiness and response, including incident command, executive communications, stakeholder coordination, evidence preservation, regulatory notifications, recovery priorities, exercises, and after-action reviews
• Establish risk-based vulnerability management, privileged-access, least-privilege, network segmentation, exposure management, and security monitoring practices
• Lead OCTA's Data Privacy and Data Classification Program, including sensitive-data discovery, information protection, data loss prevention, handling requirements, and data lifecycle considerations
• Establish cybersecurity governance for artificial intelligence and emerging technologies, ensuring appropriate safeguards and human oversight
• Direct third-party and supply-chain cybersecurity risk management, including vendor due diligence, contractual security requirements, monitoring, incident coordination, and remediation
• Promote secure-by-design practices so cybersecurity considerations are incorporated early into technology projects, procurements, cloud modernization, system development, and operational changes
• Partner closely with IS Operations and business leaders to develop practical, risk-informed security solutions that protect OCTA while supporting operational continuity and organizational objectives
• Direct analysis of threat intelligence, security events, vulnerabilities, control performance, audit findings, third-party risks, and emerging technologies to identify trends and required actions
• Lead targeted security awareness and role-based training programs and establish measures to evaluate effectiveness and compliance
• Coordinate cybersecurity audits and assessments and ensure findings and corrective actions are appropriately tracked through closure
• Develop and lead the cybersecurity workforce through mentoring, professional development, cross-training, effective use of consultants and contractors, and knowledge transfer
• Build strategic relationships with transportation agencies, regulators, law enforcement, government partners, information-sharing organizations, vendors, and industry peers to strengthen cyber preparedness and awareness

What We're Looking For

• Bachelor's degree in Computer Science, Mathematics, Business, or a related field, or an equivalent combination of education and experience
• Minimum of eight years of related cybersecurity experience in business environments,…