Manager, Cyber Security, Risk, and Compliance

Shell Mobility and Convenience USA•Houston, TX

About The Position

The Manager, Cyber Security, Risk & Compliance leads the company’s cyber security governance, information technology risk management, privacy assurance, and compliance coordination activities. This role serves as the primary point of contact for cyber threats and response coordination and works across Technology, Legal, Finance, Internal Audit, Operations, business teams, and third-party service providers to implement practical controls that protect company systems, data, customers, and operations. The position combines governance and risk leadership with hands-on coordination of security testing, awareness, vulnerability management, PCI compliance, Data Protection Impact Assessments, incident response, and remediation tracking.

Requirements

Bachelor’s degree in Information Security, Information Technology, Computer Science, Risk Management, or a related discipline, or equivalent relevant experience.
Five to seven years of progressive experience in cyber security, information security, IT risk, governance, compliance, privacy, or technology assurance.
Practical experience conducting IT risk assessments and designing, implementing, or testing controls.
Working knowledge of PCI DSS, privacy impact assessments, vulnerability management, security awareness, and incident response.
Experience coordinating audits, assessors, evidence collection, remediation plans, and cross-functional stakeholders.
Ability to communicate technical risk in clear business language and influence action without relying on direct authority.
Strong organization, judgment, documentation, facilitation, and follow-through skills.

Nice To Haves

Experience in retail, convenience, fuel, payments, or another distributed operating environment.
Familiarity with recognized frameworks such as NIST Cybersecurity Framework, CIS Controls, ISO/IEC 27001, or COBIT.
Experience working with managed security service providers, external assessors, legal counsel, and cyber insurance providers.
One or more relevant certifications, such as CISM, CRISC, CISSP, Security+, PCI ISA, ISO 27001, CIPP, or CIPM.

Responsibilities

Lead IT risk assessments for applications, infrastructure, projects, business processes, acquisitions, and third-party services.
Maintain an IT and cyber security risk register, including risk owners, treatment plans, target dates, residual risk, and approved risk acceptances.
Design, document, implement, and test preventive, detective, and corrective controls.
Advise project teams and business owners on proportionate risk treatment and control requirements.
Track remediation commitments and escalate overdue or material risks to leadership.
Develop and maintain cyber security policies, standards, procedures, control baselines, and incident response playbooks.
Act as the primary company focal point for cyber threats, suspected compromises, security incidents, and response coordination.
Coordinate triage, containment, investigation, recovery, communications, and lessons learned with internal teams and service providers.
Monitor relevant threat intelligence, vulnerabilities, and emerging risks and translate them into business actions.
Coordinate routine security testing, including phishing simulations, external vulnerability scans, penetration tests, and control validation.
Oversee remediation of vulnerabilities and security findings through closure.
Coordinate Payment Card Industry Data Security Standard compliance activities and serve as the central contact for assessors and internal stakeholders.
Maintain the PCI compliance calendar, scope, evidence requests, responsibility assignments, and remediation plans.
Coordinate external scans, testing, attestations, and audit evidence collection.
Support internal and external audits and track findings and corrective actions to closure.
Coordinate Data Protection Impact Assessments for new or materially changed systems, processes, integrations, vendors, analytics, and artificial intelligence use cases.
Work with Legal, Privacy, Architecture, Procurement, business owners, and technology teams to identify privacy risks and define controls.
Maintain assessment records, data-flow documentation, approvals, risk decisions, and mitigation actions.
Support privacy incident response and other data-protection assurance activities.
Own the cyber security awareness and training program for employees and contractors.
Plan and conduct phishing simulations and targeted education for higher-risk groups.
Develop practical communications on current threats, secure behaviors, and employee responsibilities.
Measure completion, simulation outcomes, repeat-risk patterns, and improvement actions.
Perform or coordinate security, privacy, and technology risk reviews of vendors and service providers.
Define security and data-protection requirements for procurement, contracts, onboarding, and ongoing monitoring.
Embed security and privacy requirements into project delivery and technology change processes.
Partner with vendors and managed security providers to validate performance and resolve control gaps.
Provide concise risk, compliance, vulnerability, incident, and training updates to IT and business leadership.
Develop meaningful key risk indicators and key performance indicators for the cyber security and risk program.
Translate technical issues into clear business impacts, options, decisions, and accountabilities.
Build effective working relationships with business leaders, auditors, legal counsel, assessors, vendors, and technical teams.