Senior Controls & Compliance Specialist

GHD; Houston (TX); On-site; USD 98,000 - 164,000; Full time

Benefits offered by this job

401K

Paid time off

Holiday Pay

Wellness Benefit

Job summary

GHD in Houston, TX seeks a Senior Controls & Compliance Specialist to lead the definition, alignment and monitoring of control and compliance requirements across Information Services & Technology. You will maintain the enterprise control catalogue, map obligations, and support certification readiness while guiding governance across a global organisation.

The role demands senior-level judgment, strong communication and the ability to translate complex regulatory concepts into practical business

Qualifications

• Ten (10) or more years of relevant experience in technology risk, information security, controls, compliance, assurance or a closely related discipline
• Demonstrated experience defining, maintaining or assessing control frameworks, compliance requirements and evidence standards in a complex environment
• Experience coordinating certification readiness, reviews or assessments and supporting defensible audit submissions
• Strong analytical, problem-solving, written communication, facilitation and stakeholder engagement skills
• Experience presenting clear, actionable outcomes to senior leadership or governance forums
• Ability to work independently, manage competing priorities and maintain appropriate visibility of progress, risks and issues
• Sound judgement, commercial awareness and a practical, proportionate approach to governance
• Ability to lead through influence, build effective virtual teams and mentor less experienced team members

Responsibilities

• Own and maintain the IS&T control catalogue, mapping controls to applicable regulatory, legal, contractual, certification and internal obligations
• Partner with control owners, Cyber Security, Architecture, Engineering, Applications, Data & AI, Privacy, Legal, Commercial and Internal Audit to clarify requirements and improve compliance maturity
• Maintain the obligations register and monitor changes in external requirements, client commitments and internal policies that affect the control environment
• Define minimum control outcomes, evidence standards, templates, traceability requirements and lifecycle expectations for accountable owners
• Define compliance and evidence requirements across areas, including third‑party risk, operational exceptions, non‑standard software and SaaS, penetration testing, vulnerability management, secure‑by‑design, enterprise applications, development and delivery, data management and AI
• Monitor compliance, overdue obligations, repeat exceptions, control adoption and systemic gaps, and report material matters to governance forums
• Set response governance, evidence expectations and approved positions for client security questionnaires without authoring routine subject‑matter responses or running the submission workflow
• Route material gaps, exceptions and out‑of‑tolerance matters to the Technology Risk Advisor and authorised decision‑makers
• Continuously improve the controls and compliance framework, guidance, reporting and supporting tools as obligations and business needs evolve
• Provide capability across certification and compliance readiness, audit coordination and the IS&T policy framework, helping maintain team coverage while recognising that external assessors make independent certification decisions.

Skills

Risk management

Information security

Governance

Stakeholder engagement

Analytical thinking

Written communication

Leadership

Independent work

Education

Degree in Computer Science, Information Systems, Cyber Security, Risk, Business

Certifications such as CISA, CRISC, CISM, CISSP, ISO 27001 Lead Implementer/Auditor

Tools

ISO 27001

NIST frameworks

SOC 2

Abides by ASD Essential Eight

Job description

Job Description

At GHD, we don’t just believe in the power of commitment, we live and breathe it every day.

That’s why we pledge to support and empower all of our people to make a positive impact when working hand in hand with our business to drive change. We’ll help you accelerate your career and empower you with the right technology and training as you bring ideas and projects to life.

Job Description

Who are we looking for?

Are you an experienced controls and compliance professional who can set clear governance expectations, translate complex obligations into practical requirements, and strengthen compliance without taking over first‑line accountabilities? We’re seeking a Senior Controls & Compliance Specialist to lead the definition, alignment and monitoring of control and compliance requirements across Information Services & Technology.

In this senior second‑line governance and oversight role, you’ll maintain the enterprise control catalogue and obligation mapping, establish evidence standards, coordinate certification readiness and the policy framework, and provide clear reporting on compliance trends and systemic gaps. You’ll enable accountable function and service owners by setting guardrails and clarifying requirements, without operating their controls, workflows, registers or routine approvals.

As a senior controls and compliance professional, you will:

• Own and maintain the IS&T control catalogue, mapping controls to applicable regulatory, legal, contractual, certification and internal obligations
• Partner with control owners, Cyber Security, Architecture, Engineering, Applications, Data & AI, Privacy, Legal, Commercial and Internal Audit to clarify requirements and improve compliance maturity
• Maintain the obligations register and monitor changes in external requirements, client commitments and internal policies that affect the control environment
• Define minimum control outcomes, evidence standards, templates, traceability requirements and lifecycle expectations for accountable owners
• Define compliance and evidence requirements across areas, including third‑party risk, operational exceptions, non‑standard software and SaaS, penetration testing, vulnerability management, secure‑by‑design, enterprise applications, development and delivery, data management and AI
• Monitor compliance, overdue obligations, repeat exceptions, control adoption and systemic gaps, and report material matters to governance forums
• Set response governance, evidence expectations and approved positions for client security questionnaires without authoring routine subject‑matter responses or running the submission workflow
• Route material gaps, exceptions and out‑of‑tolerance matters to the Technology Risk Advisor and authorised decision‑makers
• Continuously improve the controls and compliance framework, guidance, reporting and supporting tools as obligations and business needs evolve
• Provide capability across certification and compliance readiness, audit coordination and the IS&T policy framework, helping maintain team coverage while recognising that external assessors make independent certification decisions.

What You’ll Bring

We’re looking for a practical, independent second‑line professional who combines controls and compliance expertise with strong judgement, attention to detail and the confidence to challenge constructively. You’ll be able to translate technical, control and compliance matters into clear business implications, establish defensible evidence expectations, and influence accountable owners across a complex global organisation.

You’ll be a strong fit if you have led complex controls, compliance or assurance programs; maintained control frameworks and obligation mappings; coordinated certification readiness; and presented evidence‑based outcomes to senior leaders or governance forums.

It’s likely not a fit if your background is primarily hands‑on control operation, routine workflow administration or first‑line ownership of remediation and operational decisions.

Required Experience

• Ten (10) or more years of relevant experience in technology risk, information security, controls, compliance, assurance or a closely related discipline
• Demonstrated experience defining, maintaining or assessing control frameworks, compliance requirements and evidence standards in a complex environment
• Experience coordinating certification readiness, reviews or assessments and supporting defensible audit submissions
• Strong analytical, problem‑solving, written communication, facilitation and stakeholder engagement skills
• Experience presenting clear, actionable outcomes to senior leadership or governance forums
• Ability to work independently, manage competing priorities and maintain appropriate visibility of progress, risks and issues
• Sound judgement, commercial awareness and a practical, proportionate approach to governance
• Ability to lead through influence, build effective virtual teams and mentor less experienced team members

Technical Knowledge

• Experience with some or all of the following is highly desirable:
• ISO/IEC 27001
• NIST frameworks and security controls
• CMMC and client security requirements
• ASD Essential Eight
• Cyber Essentials
• SOC 2 or equivalent assurance frameworks
• Control catalogues, obligation registers and evidence traceability
• Certification readiness, policy governance and compliance reporting
• Third‑party risk, vulnerability management, secure‑by‑design, data management and AI governance requirements

Qualifications

A degree in Computer Science, Information Systems, Cyber Security, Risk, Business or a related field is highly regarded

Relevant certifications such as CISA, CRISC, CISM, CISSP, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor or equivalent are highly regarded

Benefits

• 401K - Employees are eligible to participate on the first day of the month following 3 months of service
• Paid time off – Our PTO benefit is designed to provide eligible employees with a period of rest and relaxation, sick, and personal time throughout the year. PTO starts at 16 days per year and increases with years of service
• Holiday Pay - Holiday pay is provided for eligible employees. GHD observes 9 holidays per year. Holiday pay will be based on the regular set schedule for the employee
• Wellness Benefit- Regular full-term employees are eligible to participate in the wellness reimbursement program. GHD will reimburse 50% of the cost of the following to maximum of $250.00 reimbursement annually for such items as: Health club membership fees, Home exercise equipment purchases, Bicycles, Race, run & marathon entrance fees, Smoking cessation programs, Weight loss programs (i.e.—Weight Watchers, Jenny Craig), Fitbits and Fitness Tracking devices

Salary range: $98,250.00 - $163,750.00 based on experience and location

As a multicultural organization, we encourage individual achievement and recognize the strength of a diverse workforce. GHD is an equal opportunity employer. We provide equal employment opportunities to all qualified employees and applicants without regard to race, creed, religion, national origin, citizenship, color, sex, sexual orientation, gender identity, age, disability, marital status or veteran status.

About Us

Take on some of the world’s toughest challenges - with GHD supporting you every step of the way.

We'll give you control over your career, empower you to find innovative solutions and help you create a lasting impact.

See where your commitment could take you with GHD.

Our Pledge to You

At GHD, we don’t just believe in the power of commitment, we live and breathe it every day.

That’s why we pledge to empower our people to make a positive impact. Combining our deep technical expertise with the capabilities of our clients and partners, we respond to some of the most complex challenges facing our planet today.

See where your commitment could take you.

That’s the #PowerOfCommitment

Who We Are

GHD is a global professional services company that leads through engineering, architecture, and construction expertise. We are an employee‑owned company with over 11,000 diverse and skilled individuals, across more than 200 offices spanning five continents.

The Power of Commitment is our brand promise. It’s what makes us different. We are bound to our stated vision and determination to address humanity’s most urgent needs: to make water, energy and urbanisation sustainable for generations to come.