Principal Information Security Engineer - Governance & Risk (Remote)

FERGUSON

4d•$10,595 - $18,536•Remote

About The Position

The Principal Information Security Engineer – Governance & Risk advances Ferguson’s enterprise cybersecurity risk and governance strategy. The role leads critical programs including Third-Party Risk Assessment (TPRA), NIST Cybersecurity Framework (CSF) transformation, external security posture management, and cybersecurity risk oversight. As a senior cybersecurity subject matter expert, the engineer evolves the third-party risk program and modernizes assessments to improve efficiency, scalability, business engagement, and risk-based decisions. The role also matures adoption of the NIST CSF by establishing sustainable governance and measurement practices aligned with enterprise risk and business priorities. The position provides strategic oversight of external security posture and cyber exposure, including security ratings, continuous third-party monitoring, attack surface visibility, remediation tracking, and executive reporting. It leads cybersecurity support for the annual cyber insurance renewal, working with Risk Management, Legal, and executive leadership to demonstrate control effectiveness, assess underwriting readiness, and strengthen the organization’s risk posture. Working across Information Security, Technology, Internal Audit, Procurement, Legal, Enterprise Risk Management, and business leadership, the Principal Engineer advises on complex cybersecurity risks and governance decisions. The role is approved to be fully remote and can be based anywhere in the United States.

Requirements

Bachelor’s degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or a related field; an equivalent combination of education and experience will be considered.
At least 5 years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines.
Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments.
Experience developing security policies, standards, and governance processes.
Experience supporting audits, compliance initiatives, and third-party risk management programs.
Experience presenting findings and recommendations to leadership and business stakeholders.
Solid understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls.
Knowledge of cybersecurity risk management, security governance, third-party risk management, and compliance frameworks.
Ability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors.
Strong analytical, problem-solving, and critical-thinking skills.
Excellent written, verbal, and presentation communication skills.
Strong stakeholder-management and influencing capabilities.
Experience with Microsoft technologies, cloud platforms, and security reporting solutions.
Ability to lead sophisticated initiatives and drive outcomes through collaboration and influence.

Nice To Haves

Preferred certifications: CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer.

Responsibilities

Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF).
Assess and measure cybersecurity program maturity and identify opportunities for improvement.
Develop recommendations and remediation plans to address security control gaps and risk exposures.
Partner with technology and business teams to improve governance and risk management.
Support development and maintenance of security roadmaps, governance processes, and performance metrics.
Coordinate independent security assessments, audits, and risk reviews.
Lead security assessments of vendors, suppliers, and technology partners.
Review security questionnaires, penetration test reports, SOC reports, and compliance documentation.
Identify, assess, and communicate third-party security risks and remediation recommendations.
Support contract reviews to ensure appropriate security requirements are incorporated.
Contribute to and support Ferguson’s Security Awareness Program.
Develop dashboards, scorecards, and executive reporting related to cybersecurity risk and program performance.
Define and track Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and security maturity metrics.
Leverage automation and reporting tools to improve efficiency and visibility across GRC programs.
Serve as a trusted advisor and domain expert for cybersecurity governance and risk management.
Develop risk reporting methodologies that translate technical risks into business impact.
Partner with business leaders to prioritize remediation based on risk exposure, likelihood, and potential business impact.
Support development of cybersecurity and enterprise risk dashboards and executive reporting.
Build strong relationships with business and technology customers.
Communicate security risks, recommendations, and program performance to technical and non-technical audiences.
Provide strategic oversight of external security posture and cyber exposure, including security ratings, third-party monitoring, attack surface visibility, and remediation tracking.
Lead cybersecurity support for the annual cyber insurance renewal, partnering with Risk Management, Legal, and executive leadership.