Director, Cybersecurity & GRC

As Form Energy matures and scales, the Director of Cybersecurity & GRC builds and leads our cybersecurity and IT governance, risk, and compliance programs. This is a CISO-track leadership role: you will set strategy and lead a team — a GRC Manager who owns IT general controls end-to-end, a Staff Security Engineer, and a Senior Security Engineer — while owning the security program, the policy and standards lifecycle, enterprise IT risk, and the external-audit relationship.

You will mature an ISO 27001-aligned information security management system and the controls a maturing, compliance-intensive company depends on, backstopped by an external advisor.

This is a hybrid role, which will require working onsite from one of our office locations 3+ days per week.

- Lead the cybersecurity program: endpoint detection and response / managed detection and response, email and web security, identity and access management, vulnerability management, threat detection, and incident response; manage security vendors and the managed SOC.

- Own IT governance, risk, and compliance — directing a GRC Manager who owns ITGC design, operation, and evidence end-to-end; the policy and standards lifecycle within an ISO 27001-aligned ISMS; the enterprise IT risk register; control mapping; and exception/issue tracking.

- Design a control framework synergistic across ITGC, SOC 2, ISO 27001, and NIST 800-171 / CMMC scopes as required by the business and customer contracts.

- Serve as the primary IT liaison to external auditors and readiness advisors — driving audit readiness, supporting fieldwork, and tracking remediation to closure; direct the external advisor backstop.

- Mature incident response and disclosure governance: incident response plan and tabletop exercises, and the cyber incident-disclosure and materiality-determination process in partnership with Legal, Finance, and IT, aligned to applicable regulatory and disclosure obligations.

- Establish data classification, retention, and encryption standards, and a vendor / third-party security risk program.

- Partner on the IT/OT security boundary and with product security, without owning operational technology or on-product (battery) cybersecurity.

- Report cybersecurity and compliance posture to leadership and governance bodies in clear, decision-ready terms.

- Lead, coach, and develop the cybersecurity and GRC team; hire selectively against clear capability gaps.

- 10+ years in cybersecurity and/or IT GRC, including 5+ years in leadership (CISO-track).

- Deep ITGC experience — control design, operation, and audit — in a compliance-intensive or scaling-company setting, with the judgment to direct a GRC Manager and external advisors.

- Breadth across the security program: IAM, EDR/MDR, vulnerability management, and incident response, with fluency in recognized frameworks (ISO 27001, SOC 2, NIST CSF / 800-53; NIST 800-171 / CMMC a plus).

- Experience as an external-audit liaison, plus policy authorship and lifecycle ownership.

- Strong people leadership and executive-grade communication, including board-quality reporting.

- Experience in manufacturing, energy, or critical-infrastructure sectors.

- Experience standing up a first-time formal IT controls environment in a scaling company.

- Familiarity with privacy regimes (GDPR / CCPA) and AI governance frameworks (Form Energy’s AI governance is led separately within the Chief Digital Officer organization; this role collaborates rather than owns it).