Senior Information Security Leader - GRC & Third-Party Risk

Ferguson; United States; Remote; USD 118,000 - 207,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k) with company match

Paid time off

Life insurance

Mental health coverage

Parental leave

Job summary

Ferguson is seeking a Principal Information Security Engineer – Governance & Risk to advance enterprise cybersecurity risk and governance. You will lead critical programs including TPRA, CSF transformation, external posture management, and risk oversight, influencing senior leadership and business outcomes.

The role emphasizes collaboration across Security, IT, Legal, Risk Management, and executives, with a focus on measurement, maturity, and continuous improvement in a fully remote, United

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field.
• 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines.
• Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments.
• Experience developing security policies, standards, and governance processes.
• Experience supporting audits, compliance initiatives, and third‑party risk management programs.

Responsibilities

• Lead enterprise cybersecurity risk assessments using the NIST CSF.
• Develop remediation plans to address security gaps and risks.
• Coordinate third-party risk management activities and evaluations.
• Produce security dashboards, metrics, and executive risk reporting.
• Collaborate with IT and business units to strengthen governance processes and controls.

Skills

Governance

Risk management

NIST CSF

Third-party risk

Policy development

Security audits

Leadership

Communication

Education

Bachelor's degree

Tools

Microsoft technologies

Cloud platforms

Job description

Ferguson is seeking a Principal Information Security Engineer – Governance & Risk to advance enterprise cybersecurity risk and governance. You will lead critical programs including TPRA, CSF transformation, external posture management, and risk oversight, influencing senior leadership and business outcomes.

The role emphasizes collaboration across Security, IT, Legal, Risk Management, and executives, with a focus on measurement, maturity, and continuous improvement in a fully remote, United