> Markdown version of [/jobs/ext/1683695-director-cybersecurity-grc](https://www.wearedevelopers.com/jobs/ext/1683695-director-cybersecurity-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Director, Cybersecurity & GRC - **Company:** Form Energy - **Location:** Weirton, WV, United States - **Experience:** Expert - **Salary:** $199,950.0 - $293,835.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, Identity and Access Management, Issue Tracking Systems, IT Management, Intrusion Detection and Prevention, Web Application Security, Software Vulnerability Management, Information Security Management System, Data Classification, IT General Controls (ITGC) - **Published:** July 1, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=e4940ab1f9309b4a ## About the Role Do you have experience in Vulnerability management?, * Deep ITGC experience - control design, operation, and audit - in a compliance-intensive or scaling-company setting, with the judgment to direct a GRC Manager and external advisors. * Breadth across the security program: IAM, EDR/MDR, vulnerability management, and incident response, with fluency in recognized frameworks (ISO 27001, SOC 2, NIST CSF / 800-53; NIST 800-171 / CMMC a plus). * Experience as an external-audit liaison, plus policy authorship and lifecycle ownership. * Strong people leadership and executive-grade communication, including board-quality reporting., * Experience in manufacturing, energy, or critical-infrastructure sectors. * Experience standing up a first-time formal IT controls environment in a scaling company. * Certifications such as CISSP, CISA, CISM, or CRISC. * Familiarity with privacy regimes (GDPR / CCPA) and AI governance frameworks (Form Energy's AI governance is led separately within the Chief Digital Officer organization; this role collaborates rather than owns it). ## Description As Form Energy matures and scales, the Director of Cybersecurity & GRC builds and leads our cybersecurity and IT governance, risk, and compliance programs. This is a CISO-track leadership role: you will set strategy and lead a team - a GRC Manager who owns IT general controls end-to-end, a Staff Security Engineer, and a Senior Security Engineer - while owning the security program, the policy and standards lifecycle, enterprise IT risk, and the external-audit relationship. You will mature an ISO 27001-aligned information security management system and the controls a maturing, compliance-intensive company depends on, backstopped by an external advisor., * Lead the cybersecurity program: endpoint detection and response / managed detection and response, email and web security, identity and access management, vulnerability management, threat detection, and incident response; manage security vendors and the managed SOC. * Own IT governance, risk, and compliance - directing a GRC Manager who owns ITGC design, operation, and evidence end-to-end; the policy and standards lifecycle within an ISO 27001-aligned ISMS; the enterprise IT risk register; control mapping; and exception/issue tracking. * Design a control framework synergistic across ITGC, SOC 2, ISO 27001, and NIST 800-171 / CMMC scopes as required by the business and customer contracts. * Serve as the primary IT liaison to external auditors and readiness advisors - driving audit readiness, supporting fieldwork, and tracking remediation to closure; direct the external advisor backstop. * Mature incident response and disclosure governance: incident response plan and tabletop exercises, and the cyber incident-disclosure and materiality-determination process in partnership with Legal, Finance, and IT, aligned to applicable regulatory and disclosure obligations. * Establish data classification, retention, and encryption standards, and a vendor / third-party security risk program. * Partner on the IT/OT security boundary and with product security, without owning operational technology or on-product (battery) cybersecurity. * Report cybersecurity and compliance posture to leadership and governance bodies in clear, decision-ready terms. * Lead, coach, and develop the cybersecurity and GRC team; hire selectively against clear capability gaps. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Your Manager Doesn’t Come with a User Manual (But You Can Totally Write One)](https://www.wearedevelopers.com/videos/1495-your-manager-doesn-t-come-with-a-user-manual-but-you-can-totally-write-one) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [How to govern Vibe Coding for the Enterprise](https://www.wearedevelopers.com/videos/100290-how-to-govern-vibe-coding-for-the-enterprise) - [Engineering/Manager Pendulum: Generating compound interest on your career](https://www.wearedevelopers.com/videos/100348-engineering-manager-pendulum-generating-compound-interest-on-your-career) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [A Guide to Green Tech and Green IT Careers](https://www.wearedevelopers.com/magazine/374-a-guide-to-green-tech-and-green-it-careers) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [What Makes WeAreDevelopers World Congress Different From Every Other Tech Event?](https://www.wearedevelopers.com/magazine/701-what-makes-wearedevelopers-world-congress-different-from-every-other-tech-event) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)