Dir, Exposure Management

Director, Exposure Management

The Director, Exposure Management leads Berkshire Hathaway Energy's enterprise cybersecurity exposure management program across information technology, operational technology, cloud, applications, software supply chain, and externally accessible environments. Reporting to the Senior Director, Security Governance, Risk & Assurance, this position directs a team of employees and is accountable for executing a risk-based, measurable approach to discovering, prioritizing, assigning ownership, validating, remediating, and governing cyber exposures across Berkshire Hathaway Energy and its affiliates.

The director advances Continuous Threat Exposure Management (CTEM), vulnerability management, external attack surface management, security assessments, application and software supply chain exposure management, offensive security validation, and remediation governance. The role partners with affiliate security teams, technology owners, application and cloud teams, risk and compliance functions, and executive leadership to focus resources on exposures that present the greatest business, operational, regulatory, and safety risk while driving clear ownership, timely remediation, and defensible risk decisions.

Exposure management strategy and governance (20%)

Develop and execute an enterprise exposure management strategy aligned with cybersecurity, business, operational, regulatory, and resilience objectives. Establish governance for exposure discovery, asset ownership, risk-based prioritization, validation, remediation, exception management, and reporting. Define decision criteria that consider threat intelligence, active exploitation, adversary behavior, known exploited vulnerabilities, exploit prediction, asset exposure, business criticality, operational impact, compensating controls, and regulatory obligations.

CTEM and vulnerability management (20%)

Lead the enterprise vulnerability and exposure management lifecycle for servers, endpoints, network infrastructure, applications, code, third-party components, cloud services, and OT environments. Mature CTEM practices across scoping, discovery, prioritization, validation, and mobilization. Ensure scanning coverage, asset inventory accuracy, data quality, ownership mapping, prioritization, remediation timelines, escalation, and risk acceptance processes are consistently defined and monitored.

External attack surface and exposure discovery (10%)

Oversee continuous identification and monitoring of internet-facing assets and services. Establish processes to identify unknown or unauthorized assets, exposed services, insecure configurations, end-of-life technology, and other externally exploitable conditions. Coordinate with responsible teams to validate ownership and reduce unnecessary attack surface.

Security assessments and validation (10%)

Direct independent security assurance activities application and cloud security assessments, automated security validation, and vendor-supported testing. Confirm whether identified exposures are exploitable, validate corrective actions, and use results to improve security controls and program priorities.

Remediation governance and risk reduction (15%)

Partner with technology and business leaders to develop and track remediation plans for material exposures. Establish a remediation operating model with clear intake, triage, owner assignment, due dates, escalation, validation, closure criteria, and exception processes. Separate routine operating system and technology lifecycle patching from vulnerability-driven remediation while maintaining an integrated view of enterprise exposure. Identify recurring conditions and systemic weaknesses, and sponsor sustainable corrective actions that create lasting ownership and remediation accountability.

Metrics, reporting, and executive communication (10%)

Develop executive-level scorecards, dashboards, and narratives that emphasize measurable risk reduction, exposure reduction, remediation effectiveness, aged exposure reduction, service-level performance, attack surface reduction, asset coverage, ownership quality, validation pass rates, and risk exception trends rather than vulnerability volume alone. Communicate significant exposures, trends, constraints, and decisions to leadership and governance forums.

Affiliate enablement and enterprise consistency (5%)

Establish common exposure management standards, processes, metrics, and governance expectations across Berkshire Hathaway Energy while enabling affiliate-specific execution based on technology environment, operational constraints, regulatory obligations, and business risk. Promote consistent ownership, prioritization, exception handling, and executive reporting while recognizing differences across affiliate operating models.

Leadership, change management, and administration (10%)

Select, coach, develop, and evaluate team members. Set priorities, establish performance expectations, support succession and career…