Lead Information Security Engineer - Governance & Risk (GRC)

Ferguson is a leading provider of quality supplies across various industries, aiming to make complex projects simple and successful. The Lead Information Security Engineer - Governance & Risk is responsible for enhancing the security framework through risk management, governance, and security awareness programs while collaborating with multiple teams to mitigate cybersecurity risks.

Responsibilities:

• Lead cybersecurity risk assessments and security maturity evaluations using industry frameworks, including NIST CSF, identifying control gaps, emerging risks, and opportunities to strengthen Ferguson's security posture
• Develop risk mitigation strategies, remediation plans, and governance recommendations, partnering with business and technology teams to drive sustainable risk reduction
• Support the development and continuous improvement of cybersecurity governance processes, security roadmaps, risk registers, and program performance metrics
• Coordinate and support internal and external audits, independent security assessments, regulatory reviews, and risk management initiatives
• Lead Ferguson's enterprise simulated phishing exercises and cybersecurity education program, developing risk-based campaigns and targeted training initiatives that improve employee awareness and cyber resilience
• Analyze phishing simulation results, reporting trends, and awareness metrics to identify risks, measure efficiency, and drive ongoing improvement of security culture
• Partner with business leaders, Human Resources, Corporate Communications, and Information Security teams to reduce phishing susceptibility and increase employee engagement in security procedures
• Conduct security assessments of vendors, suppliers, and technology partners as part of Ferguson's third-party risk management program
• Review security questionnaires, SOC reports, penetration test results, compliance certifications, and other security documentation to evaluate vendor risk
• Identify, assess, and communicate third-party security risks, providing recommendations to support informed business decisions and remediation efforts
• Collaborate with Procurement, Legal, and business customers to help ensure appropriate security requirements are incorporated into third-party engagements
• Develop and maintain cybersecurity dashboards, scorecards, important metrics, KRIs, and executive reporting that provide access to risk, compliance, and program performance
• Apply reporting and automation tools to improve the efficiency, effectiveness, and scalability of Governance, Risk, and Compliance (GRC) activities
• Translate technical risks into business-focused insights, helping leaders understand risk exposure, prioritize remediation efforts, and make informed decisions
• Serve as a trusted advisor on cybersecurity governance, risk management, and compliance matters, building strong partnerships across business and technology teams
• Communicate security risks, recommendations, and program outcomes effectively to both technical and non-technical audiences, including senior leadership

Requirements:

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or a related field; equivalent combination of education and experience will be considered
• 5+ years of experience in Information Security, Cybersecurity, IT Risk Management, IT Audit, Governance, Risk & Compliance (GRC), or related disciplines
• Experience conducting security risk assessments and evaluating security controls across on-premises, cloud, and third-party environments
• Solid understanding of cybersecurity governance, risk management, compliance frameworks, and third-party risk management practices
• Extensive knowledge of industry frameworks and standards, including NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls (ITGCs)
• Experience developing and maintaining security policies, standards, controls, and governance processes
• Experience supporting audits, regulatory compliance initiatives, risk assessments, and remediation activities
• Ability to identify, assess, prioritize, and communicate risk across applications, infrastructure, cloud services, and vendors
• Strong analytical, problem-solving, and critical thinking skills, with the ability to translate sophisticated risks into actionable recommendations
• Excellent written, verbal, presentation, and customer management skills, with experience presenting findings and recommendations to technical and business leaders
• Proven ability to lead complex initiatives, influence interested parties, and drive outcomes through multi-functional collaboration
• Experience working with Microsoft technologies, cloud platforms, and security governance or reporting tools preferred
• CISSP, CISM, CRISC, CISA, and/or ISO 27001 Lead Auditor/Lead Implementer certification