Senior Principal Cyber GRC & Third-Party Risk

ingrammicro; Irvine (CA); Sur place; USD 180 000 - 240 000; Plein temps

Résumé du poste

Ingram Micro is seeking a Sr Principal for the Governance, Risk, and Compliance (GRC) organization to lead the cybersecurity governance framework and enterprise risk program in Irvine, CA. You will drive risk assessment, remediation planning, and third‑party risk management, collaborating with legal, procurement, IT, and business leaders.

The role requires deep expertise in PCI, SOX, SOC 1/2, ISO 27001, and related controls, plus vendor contracts and risk language.

Qualifications

• 4-year college degree in MIS/CS/Business/Engineering or related field.
• At least 10 years of experience in information security, risk management, IT audit, or governance.
• PCI DSS/PIN/P2PE expertise; PCI-QSA certification preferred.
• Experience with SOX, SOC 1/2, ISO 27001, PCI DSS, CMMC, FedRAMP, HITRUST.
• Vendor risk management and contract reviews.

Responsabilités

• Develop, implement, and maintain cybersecurity governance frameworks, policies, and procedures.
• Lead enterprise risk management; maintain risk register and remediation tracking.
• Design and manage Third-Party Risk Management program with due diligence and contracting.
• Conduct compliance/audit reviews per SOX, SOC, ISO, PCI, and related frameworks.
• Prepare evidence and remediation follow-up for audits.
• Collaborate with legal, procurement, and IT for risk awareness and responsibility.
• Advise stakeholders on PCI DSS/P2PE compliance strategies and risk exposure.
• Monitor regulatory changes and update risk/compliance strategies.

Connaissances

Cybersecurity governance

Risk management

Information security

IT audit

Contract language

Vendor management

Communication to executives

Formation

Bachelor's degree in MIS/CS/Business/Engineering

Description du poste

Ingram Micro is seeking a Sr Principal for the Governance, Risk, and Compliance (GRC) organization to lead the cybersecurity governance framework and enterprise risk program in Irvine, CA. You will drive risk assessment, remediation planning, and third‑party risk management, collaborating with legal, procurement, IT, and business leaders.

The role requires deep expertise in PCI, SOX, SOC 1/2, ISO 27001, and related controls, plus vendor contracts and risk language.