Senior GRC Security Engineer - Remote

Ferguson Inc.; Ferguson (MO); Remote; USD 118,000 - 207,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k) with company match

Paid time off

Mental health coverage

Job summary

Ferguson is seeking a Principal Information Security Engineer to lead governance and risk programs, including CSF adoption and third-party risk. This role is fully remote across the United States and partners with Legal, Risk Mgmt, and executives to strengthen security maturity and risk posture.

The position requires 5+ years in information security, strong governance and risk experience, and the ability to translate technical risk into business impact for leadership audiences.

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field. Equivalent combination of education and experience will be considered.
• 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines.
• Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments.
• Experience developing security policies, standards, and governance processes.
• Experience supporting audits, compliance initiatives, and third-party risk management programs.
• Experience presenting findings and recommendations to leadership and business stakeholders.

Responsibilities

• Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF).
• Develop dashboards, scorecards, and executive reporting related to cybersecurity risk and program performance.
• Define and track Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs), and security maturity metrics.
• Partner with technology and business teams to improve governance and risk management.
• Support development of cybersecurity and enterprise risk dashboards and executive reporting.
• Lead security assessments of vendors, suppliers, and technology partners.

Skills

NIST CSF

ISO 27001

COBIT

COSO

ITGC

Communication

Stakeholder management

Cloud security

Education

Bachelor's degree in Information Security / Cybersecurity / IS / CS

5+ years in information security / IT risk management / compliance

Tools

Microsoft technologies

Cloud platforms

Security reporting solutions

Job description

Ferguson is seeking a Principal Information Security Engineer to lead governance and risk programs, including CSF adoption and third-party risk. This role is fully remote across the United States and partners with Legal, Risk Mgmt, and executives to strengthen security maturity and risk posture.

The position requires 5+ years in information security, strong governance and risk experience, and the ability to translate technical risk into business impact for leadership audiences.