Remote InfoSec Risk & Compliance Analyst (IT/OT)

CITGO Petroleum Corporation in; Houston (TX); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Remote work options

9/80 work schedule

Annual vacation incentive

Company-paid holidays

Excellent 401(k) match

Educational assistance

On-site health clinic

Job summary

CITGO Petroleum Corporation is actively seeking an Information Security Risk Management Analyst (Finance) to lead risk assessments and governance across IT and OT environments. The role focuses on policy rollout, incident response planning, and cross-functional collaboration to protect sensitive data and sustain business resilience.

The candidate will coordinate with legal, procurement, and system owners, utilizing GRC tools to document responsibilities and ensure compliance with standards like

Qualifications

• Bachelor's degree plus 8 years of experience; or associate's degree with 10 years; or high school diploma with 12 years of experience.
• Knowledge of ISO 27001 and NIST 800.53, 800.144 and 800.82.
• Familiarity with IT and OT risk contexts and supply chain cyber risk management.

Responsibilities

• Conduct comprehensive cybersecurity risk assessments across IT/OT, networks, cloud, data centers, endpoints, IoT, and applications.
• Lead governance policy rollout to system owners and document responsibilities in the GRC system.
• Coordinate third‑party risk management with Legal and Procurement; document actions in risk platforms.
• Maintain and update IT/OT incident response plans and participate in tabletop exercises.

Skills

8+ years experience

Emerging technologies awareness

Analytical problem solving

NIST/ISO awareness

IT/OT risk knowledge

TPRM knowledge

Attention to detail

CISSP/CRISC (preferred)

Education

Bachelor's degree

Associate's degree

High School diploma

Tools

GRC platform

Job description

CITGO Petroleum Corporation is actively seeking an Information Security Risk Management Analyst (Finance) to lead risk assessments and governance across IT and OT environments. The role focuses on policy rollout, incident response planning, and cross-functional collaboration to protect sensitive data and sustain business resilience.

The candidate will coordinate with legal, procurement, and system owners, utilizing GRC tools to document responsibilities and ensure compliance with standards like