Remote Principal Information Security Engineer - Governance

Ferguson Enterprises, LLC; United States; Remote; USD 118,000 - 207,000; Full time

Benefits offered by this job

Health, dental, vision benefits

401(k) with company match

Job summary

Ferguson Enterprises, LLC is seeking a Principal Information Security Engineer to advance enterprise cybersecurity governance and risk strategy. This remote role leads third‑party risk, CSF transformation, external posture, and risk oversight with executive visibility.

You will mature third‑party risk programs, align cybersecurity with business priorities, and drive sustainable governance, metrics, and risk reporting across the organization.

Qualifications

• Bachelor's degree required or equivalent experience.
• Experience leading security governance and risk programs.
• Strong knowledge of NIST CSF, ISO 27001, COBIT, COSO, and IT general controls.
• Experience with third‑party risk assessments and vendor risk management.
• Ability to present findings to leadership with business impact.

Responsibilities

• Lead enterprise cybersecurity governance and risk programs using NIST CSF.
• Manage third‑party risk assessments, vendor security questionnaires, and SOC reviews.
• Develop governance processes, performance metrics, and risk dashboards for executives.
• Provide security awareness contributions and education programs.
• Collaborate with IT, Legal, Risk, and business leaders to prioritize remediation based on risk exposure.

Skills

NIST CSF

Third-Party Risk

Cybersecurity Governance

Security Risk Assessments

ISO 27001

CISSP

CISM

CRISC

CISA

Cloud & On-Prem Security

Executive Reporting

Education

Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field

Job description

Ferguson Enterprises, LLC is seeking a Principal Information Security Engineer to advance enterprise cybersecurity governance and risk strategy. This remote role leads third‑party risk, CSF transformation, external posture, and risk oversight with executive visibility.

You will mature third‑party risk programs, align cybersecurity with business priorities, and drive sustainable governance, metrics, and risk reporting across the organization.