Director of Cybersecurity — Interim, Energy Technology GCC

The mandate

The interim director will establish control frameworks for engineering data and operational-technology environments, implementing privileged-access governance, account lifecycle management and log-retention standards across critical systems.

The interim must start within ten days for a fixed nine-month assignment through forensic closure and control certification. An internal deputy will take the role after completing two independent incident-command and assurance exercises.

Handover requires all compromise pathways closed, privileged access recertified, OT and corporate trust boundaries independently tested, critical logs retained and searchable, and the deputy able to command a severe simulated event without assistance.

The director may isolate systems, revoke access, direct forensics and approve emergency controls below ₹60 lakh. Notification decisions, production-asset shutdown and spend above ₹2 crore require global authority; the role cannot conceal or amend forensic evidence.

Broad cloud migration, physical asset maintenance and product-feature security are excluded except where directly implicated. Resources must remain on breach closure and repeatable identity, monitoring and response control.

Why this seat is open

The breach showed that local cyber reporting overstated basic control health. Immediate leadership change was necessary to preserve confidence in the investigation. A nine-month interim can close causal exposure and qualify the deputy without turning incident response into a permanent parallel hierarchy.

What you will own

• Preserve forensic evidence and reconstruct identity, endpoint, network and data events across the compromise window.
• Decide containment boundaries with operations leaders using explicit safety, continuity and adversary-persistence evidence.
• Remove dormant privilege and establish vaulting, time-bound elevation, session recording and owner recertification.
• Test segmentation between corporate engineering and operational-technology environments with safe agreed protocols.
• Restore log coverage and retention for critical assets, proving search and alert behaviour through replay.
• Run severe incident exercises that test command, notification, legal preservation and asset-safety decisions.
• Qualify the internal deputy against observed command performance and transfer the residual-risk register.

Candidate qualifications

• Eighteen-plus years in cybersecurity with incident-command responsibility in energy, industrial or critical infrastructure.
• Led containment and recovery from privileged credential compromise involving engineering or operational technology.
• Deep expertise in identity security, segmentation, detection engineering, forensic preservation and crisis governance.
• Ability to make containment choices jointly with safety-critical operations rather than applying enterprise IT assumptions blindly.
• Experience reporting material incidents and residual exposure to boards, counsel and regulated stakeholders.
• Demonstrated development of an internal security leader through realistic command simulations.