Principal Information Security Engineer – Governance & Risk

🔥 3 hours ago

🇺🇸 United States – Remote

💵 $10.6k - $18.5k / month

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Ferguson

WebsiteLinkedInAll Job Openings

10,000+ employees

🏗️ Construction

🏭 Manufacturing

📦 Logistics

Construction • Manufacturing • Logistics

Ferguson is a leading supplier of plumbing and HVAC products for residential and commercial markets. The company offers a wide range of products including water heaters, plumbing parts, and HVAC systems, as well as various tools and cleaning supplies. Ferguson provides solutions for professionals in the plumbing and HVAC industries, ensuring they have access to the resources and expertise they need for both new construction and remodeling projects.

📋 Description

• Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF) • Assess and measure cybersecurity program maturity and identify improvement opportunities • Develop recommendations and remediation plans for security control gaps and risk exposures • Partner with technology and business teams to improve governance and risk management • Support security roadmaps, governance processes, and performance metrics • Coordinate independent security assessments, audits, and risk reviews • Lead security assessments of vendors, suppliers, and technology partners • Review security questionnaires, penetration test reports, SOC reports, and compliance documentation • Identify, assess, and communicate third-party security risks and remediation recommendations • Support contract reviews to incorporate appropriate security requirements • Contribute to Ferguson's Security Awareness Program • Develop dashboards, scorecards, and executive reporting related to cybersecurity risk and program performance • Define and track KRIs, KPIs, and security maturity metrics • Leverage automation and reporting tools across GRC programs • Serve as a trusted advisor and cybersecurity governance and risk management domain expert • Develop risk reporting methodologies translating technical risks into business impact • Partner with business leaders to prioritize remediation based on risk exposure, likelihood, and potential business impact • Support cybersecurity and enterprise risk dashboards and executive reporting • Build relationships with business and technology customers • Communicate security risks, recommendations, and program performance to technical and non-technical audiences • Partner with Information Security, Technology, Internal Audit, Procurement, Legal, Enterprise Risk Management, and business leadership

🎯 Requirements

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field; equivalent combination of education and experience will be considered • 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines • Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments • Experience developing security policies, standards, and governance processes • Experience supporting audits, compliance initiatives, and third-party risk management programs • Experience presenting findings and recommendations to leadership and business stakeholders • Solid understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls • Knowledge of cybersecurity risk management, security governance, third-party risk management, and compliance frameworks • Ability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors • Experience with Microsoft technologies, cloud platforms, and security reporting solutions • Preferred certifications: CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer • Strong analytical, problem-solving, critical thinking, stakeholder management, influencing, written, verbal, and presentation skills • Ability to lead sophisticated initiatives and drive outcomes through collaboration and influence

🏖️ Benefits

• Health insurance • Dental insurance • Vision insurance • Paid time off • Life insurance • 401(k) with a company match • Mental health coverage • Gender affirming benefits • Family building benefits • Paid parental leave • Associate discounts • Community involvement opportunities • Bonus or Incentive Plan eligibility

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume