Senior Information Security Engineer – Governance & Risk (Remote)

Ferguson Inc.; United States; Remote; USD 118,000 - 207,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

Paid time off

401(k) with company match

Employee discounts

Job summary

Ferguson Enterprises is seeking a Principal Information Security Engineer – Governance & Risk for a fully remote role in the United States. The role leads critical security programs, including TPRA, CSF transformation, external security posture, and risk oversight.

You will collaborate across functions and report to executive leadership on risk posture and control effectiveness. The position emphasizes building mature governance, risk dashboards, and measurement practices, with responsibility

Qualifications

• Bachelor's degree in Information Security or related field.
• 5+ years in Information Security, IT Risk, Compliance, IT Audit, or related disciplines.
• Experience conducting security risk assessments in on-prem and cloud environments.
• Experience developing security policies, standards, and governance processes.
• Experience supporting audits, compliance initiatives, and third-party risk programs.
• Experience presenting findings and recommendations to leadership and business stakeholders.

Responsibilities

• Governance & Risk: Lead enterprise cybersecurity risk assessments using the NIST CSF and measure program maturity.
• Third-Party Risk Management: Lead security assessments of vendors and partners and review security docs.
• Security Awareness & Education: Contribute to Ferguson's Security Awareness Program.
• Metrics & Reporting: Develop dashboards, KRIs, KPIs, and security maturity metrics.
• Leadership & Influence: Advise on governance decisions and communicate risks to diverse audiences.

Skills

NIST CSF understanding

ISO 27001 knowledge

COBIT COSO ITGC

Security governance

Third-party risk management

Stakeholder management

Security reporting tools

Risk assessment

Education

Bachelor's degree in Information Security or related field

Tools

Microsoft technologies

Cloud platforms

Security reporting tools

Job description

Ferguson Enterprises is seeking a Principal Information Security Engineer – Governance & Risk for a fully remote role in the United States. The role leads critical security programs, including TPRA, CSF transformation, external security posture, and risk oversight.

You will collaborate across functions and report to executive leadership on risk posture and control effectiveness. The position emphasizes building mature governance, risk dashboards, and measurement practices, with responsibility