System Preferences > Security > FileVault
Every time you insert the disk, it will not be mounted automatically. You'll need to go into Disk Utility and right click on the disk to mount it, and enter your encryption password. If this is your own trusted computer, you can click “Remember in keychain” and then it will auto-mount each time you plug it in.
new drive came with a master boot record partition map and not GUID. If a drive is not GUID, neither the partition button nor the encryption settings are available in the graphical Disk Utility, which is why we're forced to use the command-line diskutil to partition first.diskutil list
to find out that my new drive was mapped to /dev/disk2diskutil partitionDisk /dev/disk2 GPT JHFS+ YourPartitionName 0b
…to partition the disk using a GUID partition map (GPT is the argument that specifies GUID) and Journaled HFS+.
This ran successfully and the encryption and partition options became available in Disk Utility.