Manager Information Security Governance, Risk and Compliance (Wickliffe, OH, US, 44092-2298) at Lubrizol

The manager position is accountable to manage the global Information Security Governance, Risk and Compliance functions and team furthering the maturity of both. The Team is responsible for the policies, procedures, and technologies that Lubrizol uses to comply with regulations and to mitigate threats from malicious actors and reduce the information technology vulnerabilities that negatively impact data confidentiality, integrity, and availability.  The position reports into the Sr. Manager Information Security (Predictive) within the Information Technology (IT) Division of Lubrizol.  The IT Division has team members around the world to support global IT standards and systems. 

• Lead the team to ensure compliance with cybersecurity aspects of laws or regulations, mitigate threats, and reduce vulnerabilities utilizing the risk management program to identify, assess, evaluate, and treat risks
• Mature the Risk Management and Compliance Program by recommending and implementing process improvements as well as ensuring proper governance is in place to support the program
• Develop strong relationships with IT managers, IT service owners, and control owners
• Report on overall Program progress to senior management
• Track and ensure key tasks are successfully completed by the team such as responding to risk assessments and audits from external and internal customers, governance of IT policies and standards, and compliance with regulatory controls
• Collaborate with IT staff and management to ensure proper controls are embedded within IT services, processes, and systems  
• Lead the 3rd Party Risk Management program
• Other information security activities as needed 

• Strong interpersonal and leadership skills
• Ability to effectively build relationships and work in a collaborative, matrix-driven, global environment 
• Demonstrated effectiveness of working independently, establishing priorities, and managing task completion aligned to the needs of the organization 
• Organizational awareness with an understanding of how to engage to achieve results
• Sound decision making, proactive/creative problem solving and strategic thinking skills 
• Strong IT process discipline and critical thinking skills 
• Must be able to drive clear accountability and expectations 
• Strong written and verbal communication skills required to communicate with local users, global colleagues, and leadership

Education / Certifications: 

• Bachelor’s degree in Information Technology (IT) or related field or equivalent experience.

Experience:

• Minimum of 5 years of relevant industry and professional experience (e.g., risk management, audit, third party risk, operational risk, information security, etc.)
• Minimum of 3 years leading a team
• Experience presenting to governance committees or senior management
• In-depth practical knowledge of third-party risk management, IT risk assessments, operational processes, and applicable techniques for implementation of regulatory requirements
• Operational experience with a risk management system (Archer, SAI360, etc.)
• Familiarity in security domains including identity, access, authentication, encryption, application security, network security, vulnerability and patch management, information security metrics, policies, standards, and procedures, etc.
• Experience with ISO and NIST security standards
• CRISC, CISM or CISA certifications preferred
• Experience with standards to secure industrial automation and control systems such as ISA/IEC 62443 preferred
• Expertise in tracking and analyzing emerging cybersecurity threats, risks and trends contextualizing them specific to company business processes, assets and personnel and informing stakeholders preferred

Skills & Systems:

• Microsoft Windows-based operating systems and collaboration tools
• Understanding of risk management processes 
• Knowledge of basic IT security, network security, active directory, and SAP ECC/S4 concepts
• Ability to resolve issues via undocumented methods via research and investigation  
• Experience in documenting issues and solutions to assist end user/co-worker understanding

Role Scope:

• Primary: Manager Information Security Governance, Risk and Compliance

Travel:

• Very Limited; < 5%

Work Hours:

• M-F 1st shift

Physical Demands:

• General office-type activity