Director ICS Security

We use technology to solve problems in spaces, light, and more things to come… for our customers, our communities, and our planet.

Acuity Brands, Inc. (NYSE: AYI) is a market-leading industrial technology company. We use technology to solve problems in spaces, light, and more things to come. Through our two business segments, Acuity Brands Lighting and Lighting Controls (ABL) and the Intelligent Spaces Group (ISG), we design, manufacture, and bring to market products and services that make a valuable difference in people’s lives.

We are positioned at the intersection of sustainability and technology. Our businesses develop technology that helps save our customers energy and reduce their carbon emissions. We achieve growth through the development of innovative new products and services, including lighting, lighting controls, building management solutions, and location-aware applications.

Job Summary

Have you ever entered a building and been immersed in a sea of lights and noticed the shades automatically adjust? Have you experienced a smart environment that has personalized lighting for different settings and occasions? Modern lighting and controls are everywhere, transforming how we interact with our digital world. The Industrial Control Systems (ICS) Cyber Security team plays a crucial role in safeguarding an organization’s critical infrastructure and control systems, leveraged in manufacturing our lighting, controls and building management products.

Acity Brands is the North American market leader in innovative lighting solutions. Our lights are computing, sensing, network connected platforms are everywhere where there are people. We have plenty of awesome projects to work on! Our team is expanding and looking for a security engineer to help in our endeavors.

We're seeking an experienced ICS security leader to augment the Acuity Cyber Security team. You will be responsible for developing, implementing, and managing the cybersecurity strategy for the organization’s ICS environment. This role requires a deep understanding of ICS/SCADA systems, network architecture, cybersecurity threats, and regulatory requirements. The Director will lead a team of security professionals to protect critical infrastructure, ensure compliance with industry standards, and mitigate risks associated with cyber threats. The ideal candidate will have a strong background in both cyber security and industrial control systems, with a focus on protecting ICS infrastructure.

Key Tasks & Responsibilities (Essential Functions)

Strategic Leadership:

• Develop and implement a comprehensive ICS cybersecurity strategy aligned with the organization’s overall security objectives.
• Collaborate with cross-functional teams, including IT, operations, and engineering, to integrate security into the design and deployment of ICS systems.
• Develop and assist in delivering ICS-specific cybersecurity training and awareness programs for employees and stakeholders.
• Stay current with emerging threats, vulnerabilities, and trends in ICS security, and disseminate knowledge to relevant team
• Regularly report on the status of ICS security initiatives, risks, and incidents to senior management leadership.
• Lead, mentor, and manage a team of ICS security professionals, providing direction and support to ensure effective execution of security initiatives.

Security Design and Implementation:

• Oversee the implementation of cybersecurity technologies and tools specific to ICS environments, including network monitoring, intrusion detection, and anomaly detection systems.
• Lead security assessments, penetration testing, and security audits within ICS environments, and drive remediation efforts.
• Work closely with vendors and partners to ensure that ICS solutions meet security requirements and best practices.
• Build, drive adoption and maintain security architectures for ICS environments.
• Utilize robust access control, authentication, and encryption protocols in design and implementation
• Build guidelines to implement robust network segmentation between IT and ICS networks
• Ensure backup procedures are implemented and regularly tested and that backups are isolated from network connections.

Risk Assessment and Incident Management:

• Assess and identify security risks related to ICS environments.
• Collaborate with the GRC and other supply-chain teams to implement risk mitigation controls.
• Participate in the development of incident response plans for ICS environments, and lead investigations into security incidents involving ICS.
• Investigate security incidents and perform forensic analysis.
• Monitor ICS networks for security incidents, analyze threats, and respond to incidents to minimize impact and prevent recurrence.

Security Governance and Compliance:

• Collaborate with the GRC team in creating and reviewing ICS security policies when needed.
• Assist the GRC team in conducting periodic security audits to ensure compliance with the ICS Security Policies.
• Maintain detailed documentation of security procedures, and incident reports.
• Assist in maintaining an ICS asset inventory and updating ICS inventory records.
• Collaborate with the GRC team to ensure compliance with relevant regulations, industry standards, and best practices, such as NIST, ISA/IEC 62443, and other applicable frameworks.

System Hardening and Patch Management:

• Develop and implement system hardening techniques to protect ICS from cyber threats.
• Assist appropriate teams with the ICS patching lifecycles. Assist asset owners in communications with vendors to identify proper patch levels and schedule device updates.
• Familiarize with each factory's BCP/DR Plans and ensuring that critical ICS devices and systems are covered. Assist in testing BCP/DR plans to assess readiness

Skills and Minimum Experience Required

• Strong understanding of cybersecurity frameworks for ICS/OT environments (ISA-99/IEC 62443, NIST SP 800-82, CIS, etc.)
• Extensive experience with IT and ICS security best practices; a practical understanding of the differences
• Extensive knowledge of ICS environments, including SCADA, DCS, PLCs, and other industrial control systems.
• Knowledge of protocols common in ICS environments (e.g., Ethernet/IP, CIP, Modbus, OPC, etc.) and industrial networking topologies (e.g., ring, star, etc.)
• Familiar with security technologies within the ICS environment, such as firewall logs, IDS, endpoint security solutions, access control systems, and other related security technologies.
• Strong understanding of network architecture and cybersecurity principles.
• Excellent analytical, problem-solving, and communication skills.
• Ability to work independently and as part of a multidisciplinary team.
• Minimum of 10 years of experience in information security, with at least 5 years focused on ICS/SCADA security.
• Proven track record in leading ICS security programs and managing teams.

Preferred Skills and Experience

• You have a hacker mentality and like to take things apart to see how they work.
• You are proactive, passionate and optimistic.
• You are innovative – you challenge assumptions.
• You encourage those around you to create their best work.
• You work for the best interest of the group at all times.
• You have unwavering personal integrity and a strong work ethic.
• You graciously give and receive feedback.
• You have strong understanding of network security principles and practices.
• You have experience with security tools and technologies (e.g., firewalls, IDS/IPS, SIEM).
• You have familiarity with regulatory frameworks and standards (e.g., NIST, ISA/IEC 62443).
• Relevant certifications such as CISSP, CISM, GICSP, or similar
• You have excellent problem-solving skills and attention to detail.

Travel Requirements

We value diversity and are an equal opportunity employer. All qualified applicants will be considered for employment without regards to race, color, age, gender, sexual orientation, gender identity and expression, ethnicity or national origin, disability, pregnancy, religion, covered veteran status, protected genetic information, or any other characteristic protected by law.

Accommodation for Applicants with Disabilities: As an equal opportunity employer, Acuity Brands is committed to providing reasonable accommodations in its application process for qualified individuals with disabilities and disabled veterans. If you have difficulty using our online system due to a disability and need an accommodation, you may contact us at (770) 922-9000. Please clearly indicate what type of accommodation you are requesting and for what requisition.

Any unsolicited resumes sent to Acuity Brands from a third party, such as an Agency recruiter, including unsolicited resumes sent to an Acuity Brands mailing address, fax machine or email address, directly to Acuity Brands employees, or to Acuity Brands resume database will be considered Acuity Brands property. Acuity Brands will NOT pay a fee for any placement resulting from the receipt of an unsolicited resume.

Acuity Brands will consider any candidate for whom an Agency has submitted an unsolicited resume to have been referred by the Agency free of any charges or fees. This includes any Agency that is an approved/engaged vendor, but does not have the appropriate approvals to be engaged on a search.

E-Verify Participation Poster

e-verify.gov

eeoc.gov

The range for this position is $131,000.00 to $235,700.00. Placement within this range may vary, depending on the applicant’s experience and geographic location.