Director of Information Security Governance Risk and Compliance

NEPSE Trading; Galveston (TX); Hybrid; USD 180,000 - 230,000; Full time

Benefits offered by this job

401(k) plan

Health & dental plan

Holiday & vacation pay

Employee Assistance Program

Job summary

Gulf Copper LLC, a leader in marine repair and construction, seeks a Director of Information Security Governance, Risk and Compliance. You will guide cyber risk management, policy development and assurance programs while coordinating with Legal, Quality, and Operations.

The role requires deep knowledge of NIST, DFARS, ITAR, and ISO 27001, with a track record of influencing leadership and driving compliance across multiple functions. Remote work is available in some capacities.

Qualifications

• Bachelor’s degree in information security, cybersecurity, risk management or related field; equivalent experience considered.
• At least 10 years in information security governance, risk, compliance or assurance with leadership experience.
• Strong knowledge of NIST CSF, NIST SP 800-171, CMMC, DFARS, CIS Controls, ISO/IEC 27001.

Responsibilities

• Advise the CISO and executives on material cyber risk and compliance.
• Lead the GRC program and align with enterprise risk management processes.
• Develop and govern information security policies, standards and controls.
• Coordinate external audits, regulatory examinations and customer reviews.

Skills

GRC leadership

Risk management

Policy development

Executive communication

Education

Bachelor's in information security or related

Master's preferred

Tools

NIST CSF

CMMC / DFARS compliance

ISO 27001

Job description

# Director of Information Security Governance Risk and ComplianceGulf Copper and ManufacturingUnited StatesFull timeRemoteApply by Jan 5, 2027## About the roleDIRECTOR OF INFORMATION SECURITY GOVERNANCE RISK AND COMPLIANCE### Company OverviewGulf Copper LLC, a subsidiary of Davie Defense, is a leading Marine Repair and New Construction company based in Galveston, Texas, with more than 75 years of ship repair and fabrication experience on the Gulf Coast. Gulf Copper’s primary business is the repair and refurbishment of marine vessels, ship construction, and fabrication for transportation, government, and oil and gas markets.### Benefits401 (k) Group Health & Dental Plan Short-& Long-Term Disability Insurance Life & Voluntary Life Insurance Holiday & Vacation Pay Employee Assistance Program. Position Summary: The Director, Information Security Governance, Risk and Compliance leads the organization’s information security governance, cyber and technology risk, security compliance, and assurance programs. Reporting to the CISO, the Director oversees the Information Security Management System, security policies and standards, cyber-risk management, control governance, assessments, customer assurance, and security-related remediation.The Director establishes a risk-based control and compliance program aligned with applicable### requirementsand frameworks, including NIST CSF, NIST SP 800-171, CMMC, DFARS, CIS Controls, ISO/IEC 27001, ITAR-related information-protection requirements, and contractual obligations. The role advises executive leadership on material cyber risk, control effectiveness, compliance, and audit readiness. The position partners with Legal, Contracts, Quality, Supply Chain, Human Resources, Internal Audit, Engineering, Operations, and other business functions.These functions retain ownership of their respective legal, contractual, quality, personnel, operational, and regulatory### responsibilities. Essential Duties and Responsibilities: This position is responsible for the following: Other duties may be assigned. Information Security Governance & Cyber Risk Management: Advise the CISO and executive leadership on material cyber risk and compliance.Translate regulatory and contractual security requirements into risk-based business recommendations. Lead the Information Security GRC program and maintain the cyber and technology risk-management framework. Maintain risk registers and integrate material cyber and technology risks into the enterprise risk process.Lead risk assessments, treatment planning, exception management, and executive risk reporting. Develop and govern information security policies, standards, and control requirements. Establish KPIs and KRIs for risk, compliance, control performance, and remediation.Facilitate formal risk acceptance by authorized business and executive risk owners. Information Security Controls & Compliance: Govern the organization's information security control framework using the Secure Controls Framework (SCF) for control mapping and harmonization. Maintain alignment with applicable requirements, including NIST CSF, NIST SP 800-171, CMMC, CIS Controls, ISO/IEC 27001, DFARS, FAR, ITAR-related information-protection requirements, and applicable privacy requirements.Monitor regulatory and contractual developments and advise leadership on material impacts. Provide security-control oversight supporting privacy, data protection, and Quality Management System requirements. Define control requirements and oversee implementation, while business and technology owners remain accountable for control operation, remediation, and evidence.Assurance & Customer Compliance: Maintain a risk-based internal security assessment and assurance program. Coordinate security-related external audits, certification assessments, regulatory examinations, and customer reviews. Track findings, control deficiencies, and corrective actions through resolution.Support customer security questionnaires, compliance attestations, and assurance activities. Incident Management & Investigations: Provide governance oversight for information security and technology incidents, including control-failure analysis, corrective actions, and lessons learned. Lead or support investigations within assigned authority and coordinate with Legal, HR, Privacy, Quality, Safety, and Operations as appropriate.Ensure investigation records and evidence are appropriately preserved. Security Awareness & Third-Party Risk: Establish Lead information security training and awareness programs. Lead the information security and technology-risk component of third-party risk management in coordination with Supply Chain, Legal, Contracts, IT Operations, and business owners.Define security due-diligence requirements, assess third-party security risks, recommend appropriate controls, and track identified deficiencies. Required Education & Experience: Required qualifications: Bachelor’s degree in information security, cybersecurity, risk management, information systems, business, engineering, or a related field, or equivalent relevant experience. At least 10 years of progressively responsible experience in information security governance, cyber risk, compliance, audit, security assurance, or related disciplines, including at least 3 years in a leadership or program-management role.Demonstrated experience developing or operating information security governance, risk, compliance, and assurance programs. Working knowledge of NIST SP 800-171, NIST CSF, CMMC, DFARS cybersecurity requirements, CIS Controls, and ISO/IEC 27001. Experience managing assessments, corrective-action plans, risk registers, executive reporting, and customer security-assurance activities.Demonstrated ability to influence across business and technical functions without relying solely on direct authority. Strong written, analytical, presentation, investigation, and executive-communication skills. Preferred qualifications: Master’s degree in cybersecurity, information systems, risk management, business administration, or a related field.One or more relevant certifications, such as CISM, CRISC, CISA, CIS## Required skillsInformation Security DirectorCybersecurity Compliance DirectorGRC DirectorDirector Of Governance Risk And ComplianceInformation Security AssuranceconstructionEmployment type: Full timeLocation: United StatesRemote: RemoteSalary: Salary not disclosedPosted on: Nov 8, 2026Apply by: Jan 5, 2027Source: HimalayasApply on HimalayasYou'll be taken to the original posting to apply directly with the employer. JobsNepal aggregates this listing; the application is handled by the source.