IT Governance, Risk & Compliance Analyst

OxyChem•Houston, TX

About The Position

OxyChem is seeking a mid-level IT Governance, Risk & Compliance (GRC) Analyst to support enterprise cybersecurity governance, risk management, compliance, audit readiness, and security awareness. Working with guidance from senior team members, the analyst partners with IT, Internal Audit, Legal, Compliance, Human Resources, and business stakeholders to identify, assess, track, and communicate cybersecurity risks. The role supports risk assessments and registers, remediation tracking, audits and compliance reviews, control testing, policy maintenance, regulatory and contractual compliance, and management reporting. It also coordinates security awareness efforts and cybersecurity assessments, monitors relevant advisories, and supports risk reviews related to cloud services, artificial intelligence, digital transformation, and incident lessons learned.

Requirements

Bachelor's degree in Cyber Security, Information Systems, Computer Science, Engineering, Finance, or a related field, or equivalent relevant experience.
3–5 years of experience in cybersecurity, governance, risk, compliance, information security, audit, privacy, or third-party risk management.
Hands-on experience supporting risk assessments, audits, compliance reviews, control testing, or remediation tracking.
Experience working with GRC, audit-management, vendor-risk-management, ticketing, or workflow tools.
Experience maintaining policies, control documentation, audit evidence, risk records, or corrective action plans.
Strong organizational and project-coordination skills, including the ability to manage multiple priorities and follow through on commitments.
Clear written and verbal communication skills, including the ability to explain risk and compliance requirements to technical and non-technical audiences.
Ability to work collaboratively across business and technology teams.
Ability to travel up to 20%.

Nice To Haves

Working knowledge of the NIST Cybersecurity Framework, ISO 27001, or similar control frameworks.
Experience in a regulated, industrial, manufacturing, or operational technology environment.
One relevant certification, or progress toward certification, such as CISA, CRISC, CISM, CGRC, Security+, CISSP, ISO 27001, CDPSE, CIPM, CIPP/US, or CIPP/E.

Responsibilities

Support implementation and maintenance of cybersecurity governance, risk management, and compliance processes aligned with business objectives and established standards.
Perform IT and business risk assessments, document results, and maintain risk registers using frameworks such as the NIST Cybersecurity Framework and ISO 27001.
Track remediation activities, corrective action plans, and control gaps; follow up with owners and escalate overdue items as appropriate.
Support internal and external cybersecurity audits, assessments, and compliance reviews by coordinating evidence collection, documentation, responses, and status tracking.
Help evaluate compliance with applicable regulatory, contractual, and cybersecurity requirements, including MTSA, GDPR, and relevant industry standards.
Review cybersecurity requirements in contracts and vendor agreements, as well as exception requests and compensating-control documentation, with oversight from senior team members.
Collect, validate, and report Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), compliance metrics, and remediation progress.
Assist with development and maintenance of cybersecurity policies, standards, procedures, and guidelines.
Support periodic risk reviews and third-party cybersecurity risk management activities.
Serve as a day-to-day point of contact for audit evidence requests and compliance documentation under senior GRC leadership.
Test and assess control design and operation using established procedures, document observations, and identify opportunities for improvement.
Support cybersecurity maturity assessments, benchmarking activities, and continuous audit-readiness efforts.
Prepare management reporting on compliance status, audit findings, remediation progress, and cybersecurity risks.
Coordinate cybersecurity awareness activities, including phishing simulations, campaigns, newsletters, training, and targeted education.
Maintain metrics and reporting to evaluate awareness-program participation and effectiveness.
Partner with Human Resources, Communications, and business stakeholders to deliver consistent cybersecurity messaging.
Assist with presentations, briefings, and educational materials for employees and managers.
Identify practical opportunities to improve employee engagement and reduce human-related cybersecurity risk.
Monitor relevant government and industry cybersecurity advisories and summarize potential business impacts for review.
Coordinate logistics and follow-up activities for cybersecurity assessments, maturity reviews, vulnerability assessments, and penetration testing.
Support relationships with cybersecurity service providers, assessment partners, and third-party risk vendors.
Partner with infrastructure, application, cloud, and engineering teams to document security-control implementation and remediation status.
Assist with risk reviews involving cloud services, artificial intelligence, and digital-transformation initiatives.
Participate in cybersecurity incident reviews, lessons-learned discussions, and risk-based remediation tracking.