Senior Cyber Risk & Compliance Manager

 

Together, we own our company, our future, and our shared success.

 

As an employee-owned company, our people are Black & Veatch. We put them at the center of everything we do and empower them to grow, explore new possibilities and use their diverse talents and perspectives to solve humanity's biggest challenges in an ever-evolving world. With over 100 years of innovation in sustainable infrastructure and our expertise in engineering, procurement, consulting and construction, together we are building a world of difference.  

 

Company : Black & Veatch Corporation  

Req Id : 105398 

Opportunity Type : Staff 

Relocation eligible : No 

Full time/Part time : Full-Time  

Project Only Hire : No 

Visa Sponsorship Available: No 

Why Black and Veatch

Recognized by Glassdoor as a 2023 Top 100 place to work, Black & Veatch allows you to lend your talent and perspective to humanity’s biggest challenges in a flexible environment where you are empowered to grow and explore new possibilities. We offer competitive compensation; 401K match and benefits that start day 1. Our hybrid environment allows you to balance your work and personal life. 

 

At Black & Veatch, you own your career with purpose and meaning. You are empowered to grow and explore new possibilities at every step of your career journey. Bring your big ideas knowing you are safe to be who you are and speak up with concerns or questions and put your diverse talents and perspectives to use. 

The Opportunity

The Senior Cyber Risk & Compliance Manager will be responsible to establish and maintain the Governance, Risk and Compliance; and Privacy Program. In this role, the Compliance Manager will have the opportunity to develop and maintain Policies, Standards, Security baselines, Risk framework & treatment strategy, maintenance of compliance framework, Privacy policies and procedures, as well as build & measure KRI & KPI metrics for compliance. Additionally, the Compliance Manager will execute the planning and performance of risk assessments, while working directly with the technical and business stakeholders to identify appropriate risk factors, assess the adequacy of existing controls, assist and drive remediation of control weaknesses to ensure compliance requirements are maintained. 

Key Responsibilities

• Develop, implement, mature and champion risk management framework and processes to manage risk and control activities including risk identification, measurement, prioritization, and mitigation
• Develop and evangelize and execute on GRC strategy and roadmap through effective prioritization of critical controls and initiatives
• Develop and maintain the policies, standards and procedures lifecycle, document processes, risks, exceptions, issues & action plan
• Establish and collaborate on risk treatment strategies, risk tolerance and risk appetite with business stakeholders
• Proactively and consistently manage BV’s critical compliance frameworks, including Security Controls Framework, SOC2 Type 2, CMMC, ISO 27001, NIST CSF, GDPR, etc. 
• Lead and manage internal and external audits, such as scope definition, audit readiness, control domain walkthroughs, evidence collection and documentation
• Proactively conduct risk assessments through continuous monitoring and working with control and process owners to identify ways to mitigate risks and improve security posture
• Continuously monitor and evaluate third party risk, through vendor risk assessments and independent security reviews
• Analyze and assess the current and future risk and compliance landscape, providing realistic and pragmatic risk assessments to evolve and mature the security and compliance program
• Evolve and lead user behavior programs including annual security awareness training, awareness campaigns in partnership with communications team, and conduct phishing simulation and remedial training
• Develop and maintain GRC tools and platform to monitor and manage risks across the organization, including risk assessment workflows, risk & control dashboard, operating effectiveness of controls, risk metrics, and remediation status
• Review and negotiate contracts and third-party agreements for security and compliance obligations and for risk treatment decisions
• Establish and facilitate Cyber risk and Privacy committees to provide a comprehensive view of cyber risk and privacy issues for governance and compliance
• Develop and implement Privacy policies, privacy controls and oversee ongoing compliance of privacy requests, i