Specialist, GRC (Governance, Risk & Compliance)

LUMA Energy•Santurce - Lucchetti, PR

About The Position

The Specialist, GRC (Governance, Risk & Compliance) supports the organization’s governance, risk, and compliance program by executing audit activities, maintaining the risk register, and helping ensure adherence to cybersecurity frameworks and regulatory standards. The role participates in compliance assessments, evidence management, policy governance, and third-party risk reviews across IT and OT environments. The Specialist executes IT/OT security risk assessments and compliance reviews aligned with the LUMA Cybersecurity Controls (LCC) Program and relevant regulatory frameworks. The role maintains risk and issue tracking, supports IT audits and third-party assessments, evaluates compliance and control gaps, and tracks remediation. It also reviews technology projects for secure-by-design practices, supports incident response reviews, prepares recurring reports for leadership, contributes to vendor risk processes, and delivers cybersecurity awareness training. The position follows company policies and applicable laws and industry regulations. It also participates in storm restoration tasks and assigned drills, and performs other tasks aligned with role expectations and qualifications. Travel is 20%.

Requirements

Bachelor’s degree in Information Technology, Computer Science, Engineering, or a related field.
Five years of related experience in information security governance, risk management, compliance, or audit functions.
Demonstrated experience executing audit plans, maintaining risk registers, and supporting compliance programs.
Experience with cybersecurity frameworks such as NIST CSF, CIS Controls, NERC CIP, or equivalent standards.
Experience with evidence repositories, compliance dashboards, and GRC tools.
Knowledge of governance, risk, compliance, and audit frameworks, including NIST CSF, CIS v8, NERC CIP, and the PR Cybersecurity Act.
Strong analytical and critical-thinking skills, including the ability to interpret complex data.
Understanding of laws, regulations, and industry standards applicable to IT/OT environments.
Excellent communication skills and ability to explain technical concepts to non-technical audiences.
Ability to collaborate with cross-functional teams and external auditors.
Strong planning and organizational skills, including the ability to manage multiple audit and compliance workstreams.
Travel requirement of 20%.
Physical demands include frequently remaining stationary, pushing/pulling/reaching, and bending; seldom kneeling and grabbing; and lifting/carrying 16 to 35 pounds. Must be able to receive detailed information when spoken to.

Nice To Haves

Experience collaborating with cross-functional technical teams and external auditors in a regulated or highly controlled environment.
Preferred certifications: Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or additional NIST, NERC CIP, or cybersecurity framework certifications.
An associate’s degree in Information Technology or Computer Science may substitute for the required education when accompanied by at least eight years of experience in information security governance, risk management, compliance, or audit functions, including at least five years in a previous Specialist role.

Responsibilities

Execute IT/OT security risk assessments and compliance reviews aligned with the LUMA Cybersecurity Controls (LCC) Program and regulatory frameworks.
Maintain and update the risk register and self-identified issue tracker, including documentation, status reporting, and risk escalation.
Support and execute IT audit activities by assessing compliance with information security policies, general IT controls, and identity and access management.
Coordinate third-party assessments and support effective closure of audit findings.
Assess regulatory compliance against NIST CSF, CIS Critical Security Controls v8, the PR Cybersecurity Act, NERC CIP, CFAA, and other applicable standards; identify control gaps and track remediation.
Monitor technology projects for adherence to secure-by-design principles across IT and OT environments.
Support incident response by reviewing data protection controls, user access, log reports, and restricted information.
Prepare monthly and quarterly compliance and audit reports, including risk trends and remediation status.
Support integration of cybersecurity and compliance requirements into vendor contracts and onboarding processes.
Deliver cybersecurity awareness and training sessions across IT/OT teams.
Follow established company policies, procedures, and standards to comply with applicable laws and industry regulations.
Participate in storm restoration tasks and assigned drills.
Perform additional tasks aligned with role expectations and qualifications.