[Hiring] Principal Information Security Engineer @FERGUSON

Role Description

The Principal Information Security Engineer – IT Governance & Risk plays a key role in advancing Ferguson’s enterprise cybersecurity risk and governance strategy. This highly visible position leads several critical security programs, including:

• Third-Party Risk Assessment (TPRA)
• NIST Cybersecurity Framework (CSF) transformation
• External security posture management
• Cybersecurity risk oversight

As a senior cybersecurity subject matter expert, this role will drive the continued evolution of Ferguson’s third-party risk program, modernizing assessment processes to improve:

• Efficiency
• Scalability
• Business customer engagement
• Risk-based decision-making

The Principal Engineer will also lead efforts to mature Ferguson’s adoption of the NIST CSF, establishing sustainable governance and measurement practices that align cybersecurity capabilities with enterprise risk and business priorities.

The role provides strategic oversight of Ferguson’s external security posture and cyber exposure, including:

• BitSight security ratings
• Continuous third-party monitoring
• Attack surface visibility
• Remediation tracking
• Executive-level reporting

This position leads cybersecurity support for Ferguson’s annual cyber insurance renewal, partnering with:

• Risk Management
• Legal
• Executive leadership

Working across various departments, the Principal Engineer serves as a trusted advisor on complex cybersecurity risks and governance decisions.

Location: This role is approved to be fully remote and can be based anywhere in the United States.

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field. Equivalent combination of education and experience will be considered.
• 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines.
• Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments.
• Experience developing security policies, standards, and governance processes.
• Experience supporting audits, compliance initiatives, and third-party risk management programs.
• Experience presenting findings and recommendations to leadership and business stakeholders.
• Preferred Certifications: CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer.

Requirements

• Solid understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls.
• Knowledge of cybersecurity risk management, security governance, third-party risk management, and compliance frameworks.
• Ability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors.
• Strong analytical, problem-solving, and critical thinking skills.
• Excellent written, verbal, and presentation communication skills.
• Strong stakeholder management and influencing capabilities.
• Experience with Microsoft technologies, cloud platforms, and security reporting solutions.
• Ability to lead sophisticated initiatives and drive outcomes through collaboration and influence.

Benefits

• Health, dental, and vision insurance
• Paid time off
• Life insurance
• 401(k) with a company match
• Mental health coverage
• Gender affirming and family building benefits
• Paid parental leave
• Associate discounts
• Community involvement opportunities

Company Description

Since 1953, Ferguson has been a source of quality supplies for a variety of industries. Together We Build Better infrastructure, better homes, and better businesses. We exist to make our customers’ complex projects simple, successful, and sustainable. Ferguson, a Fortune 500 company, is proud to provide best-in-class products, service, and capabilities across various industries.