Compliance and Risk Manager

This is a fully remote position, open to applicants in Ohio.

📋 Description

• Designing, executing, and consistently enhancing Hexion's information security compliance and enterprise risk management initiatives.

• Overseeing Hexion's ISO 27001 Information Security Management System (ISMS) along with associated cloud-specific extensions.

• Leading Hexion's SOC 2 compliance initiative.

• Implementing the CIS Controls as the foundational security framework for the enterprise.

• Maintaining expertise in NIST 800-53 and integrating it into enterprise risk governance.

• Managing the internal controls assurance program.

⛳️ Requirements

• Bachelor’s degree in Information Security, Computer Science, Business Administration, or a related discipline (Master's degree preferred).

• Over 7 years of progressive experience in information security compliance, GRC, or risk management positions.

• Proven, hands-on experience in managing ISO 27001 certification programs.

• Extensive knowledge of ISO 27017 and ISO 27018 cloud security and privacy controls.

• Practical experience with SOC 2 Type II compliance.

• Proficient in CIS Controls (IG1 and IG2).

• Familiarity with NIST 800-53 control families and the NIST Risk Management Framework.

• Experience in operating enterprise risk management programs.

• Strong written communication skills.

🏝️ Benefits

• Remote-first position.

• Occasional travel to manufacturing facilities, partner locations, and engagements with auditors or certification bodies.