Senior Manager, Cybersecurity

The Senior Manager, Cybersecurity owns Apex's cybersecurity program across corporate IT, cloud, and operational technology environments, reporting to the Director of Integrated Technology Solutions (ITS). This is a senior individual-contributor role with no direct reports and real authority. You'll set security standards, review significant technology changes, direct security work carried out by ITS engineers and operations staff, and lead the response when incidents occur. You can enforce security standards and take immediate protective action against an active threat, while business leaders own decisions to accept material residual risk. This role leads Apex's cybersecurity program at a point where the direction is set, and the foundations are in place. The work now is to mature it: turning strategy into durable standards, sharper risk decisions, and a program that keeps pace as the business and the threat landscape change. You'll have broad scope, direct access to leadership, and a real hand in protecting infrastructure that supports the energy transition. The role is supported by ITS infrastructure, systems engineering, and operations teams, and by a 24/7 managed security partner that provides monitoring and initial response. You'll be the senior escalation point when incidents occur, including after hours. • Hours: Full-time • Type: Exempt • Department: Integrated Technology Solutions • Travel: 10%  • Office Location: Charlottesville, VA Primary Responsibilities:  Strategy & Risk • Lead and evolve Apex's cybersecurity strategy, roadmap, policies, and standards in partnership with the Director of ITS • Run the cybersecurity risk program, including the risk register, assessments of systems, vendors, and integrations, and security review of significant technology initiatives before implementation • Report security posture, material risk, and program performance to leadership Security Operations • Oversee vulnerability management, endpoint protection, SIEM/SOC monitoring, network and firewall governance, and cloud security posture • Own identity and access standards, including IAM, PAM, and account lifecycle • Manage relationships with managed security, SOC, and incident response partners, including performance and escalation • Direct ITS technical staff on security work, while staying hands-on enough to investigate threats and validate controls yourself OT & NERC CIP • Define cybersecurity requirements for the IT/OT boundary, including remote and vendor access, in partnership with SCADA/OT leadership • Integrate NERC CIP cybersecurity requirements into Apex's overall security framework • Work with SCADA/OT leadership to extend incident response, monitoring, vulnerability management, and vendor risk programs to OT, including protection of critical backups Incident Response & Resilience • Serve as incident commander for cybersecurity events, coordinating with Legal, Communications, leadership, insurers, forensics partners, regulators, and law enforcement • Maintain incident response plans and playbooks, and run regular tabletop exercises, including joint exercises with SCADA/OT • Own IT disaster recovery and cyber recovery planning and testing, and coordinate enterprise business continuity Enabling the Business • Set security requirements for AI, SaaS, APIs, automation, data handling, and secrets management so teams can adopt new technology responsibly • Lead security awareness, phishing simulation, and privileged-user training, and build security capability across ITS To succeed as the Senior Manager, Cybersecurity at Apex Clean Energy, you’ll need to excel within the following criteria: Required Qualifications • 8+ years of progressively responsible experience in cybersecurity, including leading securi