Interim Cybersecurity & IT Risk Lead Consultant

We need to output HTML fragment with sections for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. No Job ID etc. Remove boilerplate like "Job Type Contract Description" maybe part of description? The description includes "Job Type Contract Description". That's metadata; we can fold into a short p or drop. Probably we can include a short p with "Job Type: Contract". But they said do NOT put Job ID/requisition numbers as headings — fold minor metadata into a short

or drop it. So we can include a p with "Job Type: Contract". Also we need to preserve all substantive information. We need sections: About the role (maybe from description). Responsibilities (list of duties). Requirements (maybe required qualifications). Qualifications (maybe preferred qualifications). Skills (maybe from ideal candidate profile). Benefits, Pay, Schedule: only include if posting actually states them. The posting does not mention benefits, pay, schedule specifics. It mentions "Travel Primarily Dallas-based hybrid role. Limited travel required to operational sites." That's schedule/travel info. Could be considered Schedule? It mentions hybrid role, limited travel. That's schedule info. We could include a Schedule section with that. Benefits: none. Pay: none. So we omit Benefits and Pay. We need to use

for section headings. Use

• for any list of duties/requirements/benefits. Use

  for prose. We must not invent or summarize away detail. Must preserve all substantive info. Let's extract content. Job Type Contract Description: we can put a p: "

  Job Type: Contract

  " maybe. Then About the role: The paragraph after that: "We are seeking an experienced Cybersecurity & IT Risk Lead Consultant to help establish and mature the cybersecurity, risk, and compliance function for a rapidly growing infrastructure organization. This individual will serve as the senior internal cybersecurity leader, responsible for strengthening security governance, reducing enterprise risk, overseeing managed security providers, and building the foundation for a scalable security program. The ideal candidate brings a combination of hands-on technical expertise and strategic leadership, with experience operating in highly regulated, capital-intensive environments such as energy, industrial infrastructure, construction, utilities, critical infrastructure, or data center organizations. This role will partner closely with executive leadership, legal, compliance, operations, and external service providers to ensure cybersecurity, IT risk, and governance programs evolve alongside the organization's growth." That's About the role. Responsibilities: The bullet points under headings: Cybersecurity Program Leadership, IT Risk & Compliance, Identity & Access Management, Security Operations & Incident Response, Security Vendor & MSSP Management, Legal, eDiscovery & Data Governance, Operational Technology & Physical Security. Each has multiple sentences. We can treat each as a list item? Or we can group under Responsibilities as a list of duties. We'll create
  • each duty sentence. We need to preserve all substantive info; we can break each sentence into separate li. Let's list them: Cybersecurity Program Leadership: - Assess, design, and implement cybersecurity governance, policies, standards, and risk management frameworks. - Develop and execute a strategic cybersecurity roadmap aligned with business objectives and growth plans. - Establish security metrics, reporting, and executive-level risk visibility. - Build scalable cybersecurity processes suitable for a growing organization. IT Risk & Compliance: - Lead enterprise cybersecurity risk assessments and remediation initiatives. - Support regulatory, governance, and compliance requirements, including SOX controls and public-company cybersecurity expectations. - Assist with cybersecurity governance activities, risk reporting, and documentation aligned with SEC disclosure requirements. - Develop and maintain security policies, standards, and control frameworks. Identity & Access Management: - Oversee and enhance Identity and Access Management (IAM) and Privileged Access Management (PAM/PIM) programs. - Drive security best practices within Microsoft Entra and related identity platforms. - Improve access governance, authentication controls, and privileged account management. Security Operations & Incident Response: - Provide oversight of vulnerability management, endpoint security, cloud security, threat detection, and incident response programs. - Lead investigations, root cause analyses, and remediation efforts following security incidents or data-loss events. - Coordinate incident response activities across internal stakeholders and third-party providers. - Establish and refine security monitoring and response procedures. Security Vendor & MSSP Management: - Evaluate, select, and manage Managed Security Service Providers (MSSPs) and cybersecurity partners. - Hold external providers accountable for service delivery, performance metrics, and security outcomes. - Guide the long-term transition from outsourced services toward an internally developed security capability. Legal, eDiscovery & Data Governance: - Partner with Legal and external counsel regarding cybersecurity matters, investigations, and risk management. - Support eDiscovery, legal hold, records retention, and data governance initiatives. - Provide cybersecurity guidance related to information retention and protection policies. Operational Technology & Physical Security: - Collaborate with Facilities, Operations, and infrastructure teams to address cybersecurity risks associated with operational and physical environments. - Support governance surrounding access control systems, surveillance technologies, visitor management, and site security solutions. - Contribute to the development of OT/ICS security practices as operational infrastructure expands. Requirements: The "Required Qualifications" list. We'll put under Requirements section. List: - 10+ years of progressive experience in cybersecurity, information security, IT risk, or security consulting. - Proven track record building or maturing cybersecurity programs within growing organizations. - Strong experience across: - IAM, PAM/PIM, and Microsoft Entra - Endpoint security - Cloud security - Vulnerability management - Security operations - Incident response - Third-party/vendor risk management - Experience managing MSSPs, security consultants, and external service providers. - Strong knowledge of cybersecurity governance, risk management, and control frameworks. - Experience supporting SOX controls and public-company cybersecurity requirements. - Hands-on experience with policy development, risk assessments, remediation programs, and security program implementation. - Ability to operate effectively as both a strategic leader and hands-on contributor. - Excellent communication skills with the ability to engage executives, business stakeholders, legal teams, and technical teams. We need to format as list items; nested lists okay? Probably just flat list; but we can include sub-bullets as separate li with indentation? Simpler: keep as separate li for each bullet; for the "Strong experience across:" we can make a li then sub-items as li? Might be okay to keep as separate li with dash. Qualifications: Preferred Qualifications list. - Experience within energy, utilities, industrial infrastructure, construction, critical infrastructure, data center, or other capital-intensive environments. - Knowledge of OT/ICS cybersecurity principles and industrial control environments. - Experience supporting cyber-physical security programs. - Familiarity with SEC cybersecurity governance and disclosure requirements. - Certifications such as CISSP, CISM, CRISC, GIAC, or similar credentials. Ideal Candidate Profile: Could be Skills section. We'll put under Skills. List: - Builder mindset with experience creating structure in rapidly growing organizations. - Comfortable working in ambiguity and establishing processes from the ground up. - Capable of balancing strategy, governance, and hands-on execution. - Strong vendor management and stakeholder influence skills. - Collaborative leader who can partner across technology, operations, legal, compliance, and executive leadership teams. Travel info: "Travel Primarily Dallas-based hybrid role. Limited travel required to operational sites." This could be Schedule section. We'll make Schedule section with p containing that. Now produce HTML fragment. We need to start with maybe a p for Job Type. Let's craft:

    Job Type: Contract

    About the role

    We are seeking an experienced Cybersecurity & IT Risk Lead Consultant to help establish and mature the cybersecurity, risk, and compliance function for a rapidly growing infrastructure organization. This individual will serve as the senior internal cybersecurity leader, responsible for strengthening security governance, reducing enterprise risk, overseeing managed security providers, and building the foundation for a scalable security program. The ideal candidate brings a combination of hands-on technical expertise and strategic leadership, with experience operating in highly regulated, capital-intensive environments such as energy, industrial infrastructure, construction, utilities, critical infrastructure, or data center organizations. This role will partner closely with executive leadership, legal, compliance, operations, and external service providers to ensure cybersecurity, IT risk, and governance programs evolve alongside the organization's growth.

    Responsibilities

    • Assess, design, and implement cybersecurity governance, policies, standards, and risk management frameworks.
    • Develop and execute a strategic cybersecurity roadmap aligned with business objectives and growth plans.
    • Establish security metrics, reporting, and executive-level risk visibility.
    • Build scalable cybersecurity processes suitable for a growing organization.
    • Lead enterprise cybersecurity risk assessments and remediation initiatives.
    • Support regulatory, governance, and compliance requirements, including SOX controls and public-company cybersecurity expectations.
    • Assist with cybersecurity governance activities, risk reporting, and documentation aligned with SEC disclosure requirements.
    • Develop and maintain security policies, standards, and control frameworks.
    • Oversee and enhance Identity and Access Management (IAM) and Privileged Access Management (PAM/PIM) programs.
    • Drive security best practices within Microsoft Entra and related identity platforms.
    • Improve access governance, authentication controls, and privileged account management.
    • Provide oversight of vulnerability management, endpoint security, cloud security, threat detection, and incident response programs.
    • Lead investigations, root cause analyses, and remediation efforts following security incidents or data-loss events.
    • Coordinate incident response activities across internal stakeholders and third-party providers.
    • Establish and refine security monitoring and response procedures.
    • Evaluate, select, and manage Managed Security Service Providers (MSSPs) and cybersecurity partners.
    • Hold external providers accountable for service delivery, performance metrics, and security outcomes.
    • Guide the long-term transition from outsourced services toward an internally developed security capability.
    • Partner with Legal and external counsel regarding cybersecurity matters, investigations, and risk management.
    • Support eDiscovery, legal hold, records retention, and data governance initiatives.
    • Provide cybersecurity guidance related to information retention and protection policies.
    • Collaborate with Facilities, Operations, and infrastructure teams to address cybersecurity risks associated with operational and physical environments.
    • Support governance surrounding access control systems, surveillance technologies, visitor management, and site security solutions.
    • Contribute to the development of OT/ICS security practices as operational infrastructure expands.

    Requirements

    • 10+ years of progressive experience in cybersecurity, information security, IT risk, or security consulting.
    • Proven track record building or maturing cybersecurity programs within growing organizations.
    • Strong experience across IAM, PAM/PIM, and Microsoft Entra.
    • Strong experience across endpoint security.
    • Strong experience across cloud security.
    • Strong experience across vulnerability management.
    • Strong experience across security operations.
    • Strong experience across incident response.
    • Strong experience across third-party/vendor risk management.
    • Experience managing MSSPs, security consultants, and external service providers.
    • Strong knowledge of cybersecurity governance, risk management, and control frameworks.
    • Experience supporting SOX controls and public-company cybersecurity requirements.
    • Hands-on experience with policy development, risk assessments, remediation programs, and security program implementation.
    • Ability to operate effectively as both a strategic leader and hands-on contributor.
    • Excellent communication skills with the ability to engage executives, business stakeholders, legal teams, and technical teams.