IT GRC Lead

Job highlights

• Bachelors degree in Cybersecurity,Information Technology,Information Systems,Risk Management,or a related field,or equivalent experience. . 7-10 years of experience in cybersecurity,IT risk,GRC,IT audit,compliance,or a related field,including oversight and responsibilities pertaining to SOX ITGCs.

What You Will Do

Governance, Policies & Standards

• Establish and maintain the companys IT and cybersecurity GRC framework.
• Develop, document, maintain, and communicate security policies, standards, procedures, and guidelines.
• Map policies and controls to applicable regulatory, industry, and customer requirements.
• Establish processes for periodic policy review, approval, exception management, and attestation.
• Help define and maintain security control objectives and supporting documentation.

Risk Management

• Coordinate IT and cybersecurity risk assessments across the organization.
• Maintain the enterprise IT and cybersecurity risk register, including risk identification, ownership, mitigation plans, and reporting.
• Track remediation activities and risk acceptance/exceptions through completion.
• Support risk reporting and metrics for IT leadership and other stakeholders.
• Help establish a consistent approach for assessing and prioritizing technology and cybersecurity risks.

Compliance & Controls

• Support the companys compliance obligations and control activities, including but not limited to SOX, CMMC, UK Cyber Essentials, and other applicable regulatory, contractual, customer, and industry requirements.
• Monitor changes in applicable compliance requirements and assess their impact on the organization.
• Coordinate evidence collection, control testing, remediation, and audit requests.
• Support internal and external audits and assessments.
• Develop and maintain compliance/control matrices and documentation.
• Identify gaps and work with control owners to develop remediation plans.

Security Awareness & Training

• Support the development and administration of security awareness and training programs.
• Coordinate required cybersecurity training and employee communications.
• Track training completion and follow up on outstanding requirements.
• Help develop security awareness content, campaigns, and communications tailored to different employee audiences.
• Coordinate and execute quarterly phishing simulation activities, to include follow on learning for any failures.

Third-Party & Supply Chain Risk

• Establish and manage a third-party cybersecurity risk management process in partnership with Procurement, Legal, IT, and business stakeholders.
• Perform or coordinate security risk assessments of vendors, suppliers, and other third parties.
• Review security questionnaires, SOC reports, certifications, and other third-party security documentation.
• Track identified vendor risks, remediation activities, and risk acceptances.
• Help establish security requirements and ongoing monitoring practices for critical suppliers and service providers.

Reporting & Program Development

• Develop GRC metrics, dashboards, and management reports.
• Maintain accurate GRC documentation and records.
• Help identify opportunities to automate and improve GRC processes.
• Support cybersecurity initiatives and other activities as needed within a small, collaborative IT and Cybersecurity team.

What Makes You an Ideal Candidate

• Bachelors degree in Cybersecurity, Information Technology, Information Systems, Risk Management, or a related field, or equivalent experience.
• 7-10 years of experience in cybersecurity, IT risk, GRC, IT audit, compliance, or a related field, including oversight and responsibilities pertaining to SOX ITGCs.
• Working knowledge of cybersecurity principles, IT controls, risk management, and compliance frameworks.
• Experience developing or managing policies, standards, controls, risk assessments, or compliance programs.
• Strong analytical, organizational, documentation, and communication skills.
• Ability to work effectively with technical and non-technical stakeholders across a global organization.
• Comfortable working independently and building processes in an environment where GRC capabilities are still being established.
• Strong attention to detail and ability to manage multiple priorities and deadlines.

Enerpac Tool Group Values

Be an ambassador for the businesses and ensure that Enerpac Tool Group Values always come first:

• Safety - Safety is our highest priority and is at the heart of everything we do.
• Integrity - We will act with honesty and transparency and always do the right thing.
• Ownership - We will own our commitments, act with a sense of urgency, and deliver what is expected of us on time, or ask for help early enough.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.