IT Governance, Risk & Compliance Advisor

Oxychem; Houston (TX); On-site; USD 95,000 - 130,000; Full time

Job summary

OxyChem is seeking an IT Audit & Governance, Risk & Compliance Senior Analyst to strengthen our cybersecurity posture across governance, risk, and compliance programs. You will partner with IT, Internal Audit, Legal, Compliance, HR, and business stakeholders to ensure risks are identified and managed effectively.

The role emphasizes policy development, audits, risk assessments, and security awareness initiatives to foster a compliant and security-conscious culture across the enterprise.

Qualifications

• Bachelor's degree in Cyber Security, Information Systems, Engineering, Finance or related field.
• CRISC, CISM, CISA, CGRC, or other governance, risk, and compliance certifications.
• 5+ years of experience in cybersecurity, governance, risk, compliance, information security, audit, privacy, or third-party risk management.
• Experience leading compliance programs, audits, risk assessments, or control implementation efforts.
• Experience using and supporting GRC, audit-management, vendor-risk-management, and workflow tools.
• Experience managing policies, control documentation, audit evidence, and remediation activities.
• Strong project-management skills, including the ability to prioritize competing compliance initiatives and drive cross-functional accountability.
• Exceptional written, verbal, and stakeholder-management skills.
• Ability to travel up to 20%.

Responsibilities

• Governance, Risk & Compliance (GRC): Implement and maintain cybersecurity governance, risk management, and compliance programs; conduct risk assessments; track remediation; support audits; ensure regulatory and contractual compliance; develop KRIs and KPIs; govern policies and third-party risk management.
• IT Audit & Compliance Management: Serve as primary cybersecurity liaison for audits; coordinate evidence collection and remediation; assess control effectiveness; support maturity benchmarking; report on compliance status and risk exposure.
• Security Awareness & Culture: Design and deliver Cybersecurity Awareness Program; manage phishing simulations; track metrics; promote a strong security culture in partnership with HR and Communications.
• Technical & Operational Support: Monitor threat intel; coordinate assessments, vulnerability testing; manage vendor relationships; support cloud and AI security risk initiatives; assist in incident reviews.

Skills

CRISC

CISM

CISA

CGRC

Education

Bachelor's degree

Job description

## IT Governance, Risk & Compliance AdvisorApply: Houston, TX: Full time: Posted Today: JR107228At OxyChem, our chemistry makes modern life possible, and it is our people who make the difference. We are a safety-first, purpose-driven team committed to innovation, environmental responsibility, and doing things the right way. If you are ready to contribute, elevate your skills, and take ownership of your career, Oxychem offers the opportunity to make a difference every day. OxyChem, a Berkshire Hathaway company, is a leading producer of essential chemistry with operations in the U.S., Canada and Latin America. OxyChem’s products play an essential role in everyday life, supporting critical applications in water treatment, pharmaceuticals, healthcare, manufacturing, automotive, personal hygiene, and residential and commercial construction. OxyChem actively participates in the Occupational Safety and Health Administration Voluntary Protection Program, underscoring our commitment to safety. Headquartered in Dallas, Texas, OxyChem is a top three U.S. manufacturer of polyvinyl chloride, chlor-alkali and chlorinated organic chemicals, and calcium chloride. Visit oxychem.com for more information. In a fast-paced industry that demands precision, we create a supportive workplace where the safety and well-being of our employees are paramount. We are committed to rewarding top performers, offering very competitive pay and benefits, and providing tremendous career development opportunities. OxyChem is seeking an IT Audit & Governance, Risk & Compliance (GRC) Senior Analyst to strengthen the organization's cybersecurity posture through effective governance, risk management, compliance oversight, cybersecurity awareness, and security culture initiatives. This role serves as a key partner to IT, Internal Audit, Legal, Compliance, Human Resources, and business stakeholders to ensure cybersecurity risks are identified, assessed, managed, and communicated across the enterprise.**Key Responsibilities:** **Governance, Risk & Compliance (GRC)** • Implement and maintain cybersecurity governance, risk management, and compliance programs aligned with business objectives and industry best practices.• Conduct IT and business risk assessments and maintain risk registers aligned with frameworks such as NIST Cybersecurity Framework, ISO 27001, and other applicable standards.• Track, manage, and report remediation activities and corrective action plans through successful closure.• Support internal and external cybersecurity audits, assessments, and compliance reviews.• Ensure compliance with applicable regulations, contractual obligations, and cybersecurity requirements, including MTSA, GDPR, and industry-specific standards.• Review cybersecurity requirements within contracts, vendor agreements, exception requests, and compensating control documentation.• Develop, monitor, and report cybersecurity Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and compliance metrics to management.• Support the development, maintenance, and governance of cybersecurity policies, standards, procedures, and guidelines.• Maintain cybersecurity risk registers and facilitate periodic risk reviews with business and technology stakeholders.• Provide governance oversight for third-party cybersecurity risk management activities.**IT Audit & Compliance Management** • Serve as a primary cybersecurity liaison for Internal Audit, external auditors, assessors, and regulatory reviews.• Coordinate evidence collection, documentation reviews, and audit responses.• Assess control effectiveness and identify opportunities for strengthening cybersecurity governance and compliance processes.• Support cybersecurity maturity assessments and benchmarking activities.• Develop executive ready reporting on compliance status, audit findings, remediation progress, and cybersecurity risk exposure.• Ensure continuous audit readiness through effective documentation, control monitoring, and governance practices.**Security Awareness & Culture** • Design, implement, and continuously improve the enterprise Cybersecurity Awareness Program.• Manage phishing simulations, awareness campaigns, newsletters, training initiatives, and targeted education for high-risk user groups.• Develop metrics and reporting to measure awareness program effectiveness and organizational security culture maturity.• Partner with Human Resources, Communications, and business leaders to promote a strong cybersecurity culture.• Identify opportunities to improve employee engagement and reduce human-related cybersecurity risks.• Deliver cybersecurity awareness presentations and briefings to employees, management, and leadership teams.**Technical & Operational Support** • Monitor cyber threat intelligence sources, including government and industry advisories, and communicate relevant risks to stakeholders.• Coordinate cybersecurity assessments, maturity reviews, vulnerability assessments, and penetration testing activities.• Manage relationships with cybersecurity service providers, assessment partners, and third-party risk vendors.• Collaborate with infrastructure, application, cloud, and system engineering teams to support implementation of security controls and remediation activities.• Support the evaluation of emerging technologies and cybersecurity risks associated with cloud adoption, artificial intelligence (AI), and digital transformation initiatives.• Assist in cybersecurity incident reviews, lessons learned activities, and risk-based remediation planning.**Required Qualifications:** • Bachelor's degree or relevant years of experience in Cyber Security, Information Systems, Computer Science, Engineering, Finance or a related field.• CRISC, CISM, CISA, CGRC, or other governance, risk, and compliance certifications.• 5+ years of experience in cybersecurity, governance, risk, compliance, information security, audit, privacy, or third-party risk management.• Experience leading compliance programs, audits, risk assessments, or control implementation efforts.• Experience using and supporting GRC, audit-management, vendor-risk-management, and workflow tools.• Experience managing policies, control documentation, audit evidence, and remediation activities.• Strong project-management skills, including the ability to prioritize competing compliance initiatives and drive cross-functional accountability.• Exceptional written, verbal, and stakeholder-management skills.• Ability to communicate risk and compliance requirements effectively to both technical and non-technical audiences.• Ability to travel up to 20%.**Preferred Certifications:** • Professional certifications such as CISA, CRISC, CISSP, CISM, ISO 27001 Lead Implementer or Lead Auditor, CDPSE, CIPM, CIPP/US, CIPP/E, or similar.