Interim Director — Privileged Access in Critical Operations

Maintenance access is an operating dependency

Start with access paths into the most consequential systems. Identify shared credentials, dormant accounts, supplier entry points and privileges whose original purpose is no longer understood. Establish how maintenance actually happens before deciding which controls can be enforced immediately and which require equipment or process changes.

The director leads implementation and technology operating changes within the agreed mandate. Owners of critical systems retain responsibility for approving service-impacting activity. Success means maintenance can proceed through authorised routes, emergency arrangements have been demonstrated and privileged activity can be understood after the event without depending on personal recollection.

Implement normal and emergency routes

Implement approval, time limitation, session oversight and credential management appropriate to each environment. Work with engineering teams on systems that cannot support standard identity controls. Ensure that emergency access can be invoked during a wider identity-service failure and that its use is subsequently reconciled.

Make exceptions temporary and accountable

Set clear responsibilities for approving the work, granting access, observing sensitive activity and confirming closure. Test these responsibilities across shifts and supplier boundaries. Remove unnecessary privileges through a controlled sequence that includes a recovery option if undocumented dependencies emerge. Bring unresolved exceptions to the executive risk owner with feasible compensating measures and a date for reconsideration.

Leave a verified access model, usable maintenance procedures and a controlled exception register. Ensure account ownership survives staff and supplier changes. Establish measures that reveal unmanaged access and overdue closure rather than simply counting enrolled systems.

Evidence of practical access-control delivery

The appointment requires delivery leadership in identity, infrastructure security or technology operations, supported by experience in availability-sensitive environments. Candidates should show how they implemented privileged-access controls where legacy technology, supplier dependence and operational urgency limited the available choices.

Evidence should include adoption by technical teams, treatment of emergency access and reduction of persistent exceptions. An ability to explain control purpose to engineers and support specialists is essential. The role is unsuitable for someone whose experience is confined to producing an access policy or overseeing a product procurement.