[Hiring] Director of Information Security Governance Risk and Compliance @Gulf Copper

Role Description

The Director, Information Security Governance, Risk and Compliance leads the organization’s information security governance, cyber and technology risk, security compliance, and assurance programs. Reporting to the CISO, the Director oversees the Information Security Management System, security policies and standards, cyber-risk management, control governance, assessments, customer assurance, and security-related remediation.

The Director establishes a risk-based control and compliance program aligned with applicable requirements and frameworks, including:

• NIST CSF
• NIST SP 800-171
• CMMC
• DFARS
• CIS Controls
• ISO/IEC 27001
• ITAR-related information-protection requirements
• Contractual obligations

The role advises executive leadership on material cyber risk, control effectiveness, compliance, and audit readiness. The position partners with various business functions, retaining ownership of their respective legal, contractual, quality, personnel, operational, and regulatory responsibilities.

Qualifications

• Bachelor’s degree in information security, cybersecurity, risk management, information systems, business, engineering, or a related field, or equivalent relevant experience.
• At least 10 years of progressively responsible experience in information security governance, cyber risk, compliance, audit, security assurance, or related disciplines, including at least 3 years in a leadership or program-management role.
• Demonstrated experience developing or operating information security governance, risk, compliance, and assurance programs.
• Working knowledge of NIST SP 800-171, NIST CSF, CMMC, DFARS cybersecurity requirements, CIS Controls, and ISO/IEC 27001.
• Experience managing assessments, corrective-action plans, risk registers, executive reporting, and customer security-assurance activities.
• Demonstrated ability to influence across business and technical functions without relying solely on direct authority.
• Strong written, analytical, presentation, investigation, and executive-communication skills.

Requirements

• Master’s degree in cybersecurity, information systems, risk management, business administration, or a related field (preferred).
• One or more relevant certifications, such as CISM, CRISC, CISA, CISSP, CGRC, ISO/IEC 27001 Lead Implementer or Lead Auditor, or CIPP (preferred).
• Experience supporting defense-industrial-base, maritime, shipbuilding, manufacturing, critical-infrastructure, or government-contracting environments (preferred).
• Experience with export-controlled information, CUI, government contracting, and customer security requirements (preferred).

Benefits

• 401 (k)
• Group Health & Dental Plan
• Short-& Long-Term Disability Insurance
• Life & Voluntary Life Insurance
• Holiday & Vacation Pay
• Employee Assistance Program

Working Conditions

• Work is primarily performed in a professional office or remote-work environment, with periodic interaction across departments and operational areas.
• The position requires extended periods of sitting, computer use, reading, analysis, documentation, and communication with employees, management, customers, auditors, and other business partners.
• Occasional visits to shipyard, production, warehouse, or other operational areas may be required.
• Must comply with all applicable safety requirements and wear designated personal protective equipment when entering operational areas.
• Business travel may be required on an as-needed basis.
• Occasional work outside normal business hours may be required to support security incidents, investigations, audits, regulatory or customer deadlines, and other time-sensitive matters.

Necessary Equipment Operation

• Computer, laptop, mobile phone, and standard office equipment.
• Information security governance, risk, compliance, assessment, documentation, reporting, and collaboration systems.
• Standard personal protective equipment when entering designated operational areas.

Special Skills

• Ability to interpret security, regulatory, contractual, and control requirements and translate them into risk-based business recommendations.
• Strong leadership, executive communication, analytical, presentation, investigation, and cross-functional stakeholder-management skills.
• Ability to lead governance, risk, compliance, assurance, assessment, remediation, and third-party security-risk activities.
• Knowledge of NIST CSF, NIST SP 800-171, CMMC, DFARS, FAR, CIS Controls, ISO/IEC 27001, SCF, and ITAR-related information-protection requirements.