Principal Information Security Engineer – Governance & Risk

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee enterprise cybersecurity risk assessments utilizing the NIST Cybersecurity Framework (CSF)

• Evaluate and quantify the maturity of cybersecurity programs while identifying areas for enhancement

• Formulate recommendations and action plans to address security control deficiencies and risk vulnerabilities

• Collaborate with technology and business teams to refine governance and risk management practices

• Assist in the development of security roadmaps, governance procedures, and performance metrics

• Organize independent security assessments, audits, and risk evaluations

• Conduct security assessments for vendors, suppliers, and technology partners

• Analyze security questionnaires, penetration test findings, SOC reports, and compliance documents

• Identify, evaluate, and communicate third-party security risks along with remediation suggestions

• Aid in contract reviews to ensure the inclusion of necessary security requirements

• Contribute to Ferguson's Security Awareness Program

• Create dashboards, scorecards, and executive reports regarding cybersecurity risks and program performance

• Define and monitor Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and security maturity metrics

• Utilize automation and reporting tools across Governance, Risk, and Compliance (GRC) initiatives

• Act as a trusted advisor and expert in cybersecurity governance and risk management

• Develop methodologies for risk reporting that translate technical risks into business implications

• Collaborate with business leaders to prioritize remediation based on risk exposure, likelihood, and potential business impact

• Support cybersecurity and enterprise risk dashboards along with executive reporting

• Establish relationships with business and technology stakeholders

• Communicate security risks, recommendations, and program performance effectively to both technical and non-technical audiences

• Partner with Information Security, Technology, Internal Audit, Procurement, Legal, Enterprise Risk Management, and business leadership

⛳️ Requirements

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or a related field; equivalent combinations of education and experience will be evaluated

• 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related fields

• Proven experience conducting security risk assessments and evaluating security controls in both on-premises and cloud environments

• Experience in developing security policies, standards, and governance frameworks

• Background in supporting audits, compliance initiatives, and third-party risk management programs

• Proficient in presenting findings and recommendations to leadership and business stakeholders

• Strong understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls

• Knowledgeable in cybersecurity risk management, security governance, third-party risk management, and compliance frameworks

• Capability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors

• Experience with Microsoft technologies, cloud platforms, and security reporting solutions

• Preferred certifications include CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer

• Excellent analytical, problem-solving, critical thinking, stakeholder management, influencing, written, verbal, and presentation skills

• Ability to lead complex initiatives and achieve results through collaboration and influence

🏝️ Benefits

• Health insurance

• Dental insurance

• Vision insurance

• Paid time off

• Life insurance

• 401(k) with a company match

• Mental health coverage

• Gender affirming benefits

• Family building benefits

• Paid parental leave

• Associate discounts

• Community involvement opportunities

• Bonus or Incentive Plan eligibility