IT GRC Lead

Valvoline Global

8d•Remote

About The Position

The Sr. GRC Analyst supports Valvoline Global Operations’ IT Governance, Risk, and Compliance (GRC) function by advancing governance, data protection, and information security initiatives. The role conducts information security risk and control assessments, supports security awareness and information security maturity activities, assists with audits, and helps operationalize systems to monitor and ensure regulatory requirements and industry best practices. The Sr. GRC Analyst partners with internal and external stakeholders on process development and improvement, assessments, documentation, reviews, reporting, and analytics. The role also develops and strengthens privacy program operations, promotes efficient and sustainable processes, and translates complex privacy and data protection topics for nontechnical audiences.

Requirements

Five or more years of experience in IT or enterprise risk management, IT or operational audit, or a related field.
Knowledge of third-party risk, privacy, information security, compliance requirements, and control implementation.
Knowledge of the NIST CSF and C2M2 maturity frameworks and relevant assessment practices.
Experience assessing risk, control design, and control effectiveness for IT and operational controls.
Competence in managing audit requests, writing narratives, documenting and submitting evidence, and following up.
Experience contributing to complex projects involving stakeholders from multiple business processes.
Ability to own workflow and manage multiple priorities.

Nice To Haves

Experience with ServiceNow GRC modules, including Integrated Risk Management, Third-Party Risk Management, and/or Privacy Management.
Experience with Jira Cloud project management software.
Knowledge of NIST Cybersecurity Framework 1.1 and/or 2.0, and the Cybersecurity Capability Maturity Model for OT systems (C2M2).
Strong collaboration and communication skills, with the ability to engage effectively with peers and leadership.
Data analytics, reporting, and presenting metrics to leadership.

Responsibilities

Execute the company’s cyber risk assessment and cybersecurity compliance programs.
Lead risk assessment engagements to capture and measure cybersecurity risks, identify risk owners, and develop mitigation plans.
Monitor cybersecurity risks through continuous reassessment based on risk level.
Maintain the company’s IT General Control (ITGC) framework.
Lead consulting engagements to identify key controls, document control processes, and establish audit evidence requirements.
Drive process improvement and automation initiatives to improve IT maturity and the effectiveness of internal controls.
Report on metrics measured by the NIST CSF and C2M2-based Aramco maturity frameworks.
Guide business units on compliance requirements, industry standards, and emerging information systems risks.
Improve user acceptance, maturity, and implementation of IT-GRC systems, including ServiceNow IRM, KnowBe4, Jira, and emerging technology solutions.
Support security awareness, information security maturity, audit, privacy program, data protection, documentation, review, reporting, and analytics activities.