Director, Cybersecurity & GRCInformation Technology * Berkeley, CA; Somerville, MA; Weirton, WV

Are you ready to build America's energy future? Form Energy is an American manufacturing and energy technology company. We’re revolutionizing energy storage with cost-effective, multi-day technology designed to keep the electric grid secure and reliable, even during extended periods of stress. By strengthening the electric system and reimagining what’s possible, we’re giving clean energy a whole new form!

In recent years, Form Energy has earned a number of accolades, including being named by TIME as a "Best Invention," MIT Technology Review as a "Top Climate Tech Company To Watch," and Fast Company as "One of the Next Big Things In Tech." We are making rapid progress on our mission of delivering energy storage for a better world, and our team is growing just as rapidly to meet demand.

We have signed contracts with leading electric utilities across the United States and production of our iron‑air batteries is underway at our first high‑volume manufacturing facility in West Virginia.

Working for Form Energy is more than just a job, it’s a chance to be part of something extraordinary. And now - right as we significantly scale up battery manufacturing - might be the most exciting moment in the company’s history to join. We are assembling a team of highly talented and driven individuals across the country. Driven by our core values of humanity, excellence, and creativity, our team is determined to deliver on our mission and transform the energy landscape for the better.

As Form Energy matures and scales, the Director of Cybersecurity & GRC builds and leads our cybersecurity and IT governance, risk, and compliance programs. This is a CISO‑track leadership role: you will set strategy and lead a team – a GRC Manager who owns IT general controls end‑to‑end, a Staff Security Engineer, and a Senior Security Engineer – while owning the security program, the policy and standards lifecycle, enterprise IT risk, and the external‑audit relationship.

You will mature an ISO 27001‑aligned information security management system and the controls a maturing, compliance‑intensive company depends on, backstopped by an external advisor.

This is a hybrid role, which will require working onsite from one of our office locations 3+ days per week. Relocation assistance is available.

• Lead the cybersecurity program: endpoint detection and response / managed detection and response, email and web security, identity and access management, vulnerability management, threat detection, and incident response; manage security vendors and the managed SOC.
• Own IT governance, risk, and compliance – directing a GRC Manager who owns ITGC design, operation, and evidence end‑to‑end; the policy and standards lifecycle within an ISO 27001‑aligned ISMS; the enterprise IT risk register; control mapping; and exception/issue tracking.
• Design a control framework synergistic across ITGC, SOC 2, ISO 27001, and NIST 800‑171 / CMMC scopes as required by the business and customer contracts.
• Serve as the primary IT liaison to external auditors and readiness advisors – driving audit readiness, supporting fieldwork, and tracking remediation to closure; direct the external advisor backstop.
• Mature incident response and disclosure governance: incident response plan and tabletop exercises, and the cyber incident‑disclosure and materiality‑determination process in partnership with Legal, Finance, and IT, aligned to applicable regulatory and disclosure obligations.
• Establish data classification, retention, and encryption standards, and a vendor / third‑party security risk program.
• Partner on the IT/OT security boundary and with product security, without owning operational technology or on‑product (battery) cybersecurity.
• Report cybersecurity and compliance posture to leadership and governance bodies in clear, decision‑ready terms.
• Lead, coach, and develop the cybersecurity and GRC team; hire selectively against clear capability gaps.

• 10+ years in cybersecurity and/or IT GRC, including 5+ years in leadership…