VP & Chief Information Security Officer - Global Industrial

Genuine Parts Company•Atlanta, AL

About The Position

The Vice President (VP) & Chief Information Security Officer (CIS Officer) is responsible for strategic oversight and management of the Motion corporate security program globally. This role drives and champions the cyber and data security vision, strategy, and information security program that aligns with business goals and industry best practices. The VP & CIS Officer has a deep understanding of the evolving landscape of security and technology and collaborates directly with the senior management team and key business stakeholders to manage and resolve security incidents, as well as plan and implement information security projects to meet business objectives across the organization. This role establishes, leads, and upholds robust security practices, ensuring organizational adherence, and mitigating security risks associated with third-party vendors for compliance with these standards. This role ensures the maturation of information security systems (ISS) capabilities as Motion operates at public-company scale, including cybersecurity governance, disclosure readiness, incident materiality escalation, Sarbanes-Oxley Act (SOX)/Information Technology General Controls (ITGC) alignment, regulatory compliance, and board-level reporting. This must be done while protecting revenue-generating operations, customer trust, branch productivity, supply chain continuity, digital commerce, automation solutions, and transformation programs without introducing unnecessary friction to the business. The role serves as Motion’s senior enterprise security leader, translating cyber, data, identity, third-party, operational, and resilience risks into clear business decisions for executive leadership and the Board. This includes establishing Motion’s cyber risk appetite, security maturity roadmap, incident materiality escalation process, disclosure support model, and measurable cyber resilience objectives.

Requirements

Typically requires a bachelor’s degree in computer science, information systems, cybersecurity or a related field and fifteen (15) or more years of related experience in a publicly traded company.
Expertise in the cybersecurity field including cyber issues as well as the latest attack and enterprise defense methodologies.
Extensive experience with security systems, tools, and protocols to ensure a secure environment.
Ability to convert technical cyber exposures into clear business risk language, prioritized tradeoffs, investment choices, and executive decisions.
Ability to define roles, accountabilities, intake processes, escalation paths, service levels, control ownership, and governance routines across a federated technology environment.
Proven skill advising C-suite leaders, board committees, audit leaders, business presidents, and transformation leaders on cyber risk, investment priorities, incident readiness, and control maturity.
Ability to lead multi-year security modernization across IAM, PAM, CIAM, SOX access controls, cloud security, data protection, vulnerability management, SecOps, application security, and third-party risk.
Ability to attract, assess, develop, retain, and organize high-performing cyber talent, including leaders of leaders, technical specialists, managed service partners, and cross functional business risk owners.
Ability to align ISS decisions with revenue growth, customer experience, branch productivity, margin improvement, digital enablement, acquisition integration, and enterprise cost discipline.
Ability to establish security standards for AI adoption, automation, data protection, identity controls, vendor risk, and responsible use of emerging technologies.
Ability to lead cross-functional response during major security events, aligning Legal, Communications, HR, Finance, Operations, Internal Audit, technology teams, and executive leadership.
Consistent track record of leadership, teamwork, and delivering high impact results.
Experience managing large teams made up of diverse geographies, functional matrices and leading leaders.
Strong fiscal prudence to maximize technology investments against critical business priorities across the enterprise.
Exceptional communication skills, team building and associate growth and development experience.

Nice To Haves

Master’s degree in a related field preferred.
Advanced certifications preferred, such as CISSP, CISM, CRISC, CISA, CCSP, or equivalent executive security credentials.

Responsibilities

Establishes and executes the strategic direction of Motion’s ISS, Identity Access Management (IAM), Cyber Defense Security Services/Engineering, and Governance Risk & Compliance (GRC) in collaboration with company leadership.
Continuously matures Motion’s enterprise ISS operating model, including security strategy, governance, architecture, cyber defense, identity, GRC, third-party risk, application security, data protection, privacy, and incident response.
Creates an enterprise-wide risk prioritization process that links cyber remediation to business impact, critical processes, customer obligations, regulatory exposure, and resilience requirements.
Establishes and maintains Motion’s enterprise cybersecurity governance model, including cyber risk appetite, control ownership, exception management, executive escalation, board reporting cadence, and audit-ready evidence.
Defines business risk associated with security initiatives and guides the business towards decisions that will mitigate that risk without hampering the ability to conduct business.
Ensures executives are kept apprised of proposed programs, risk mitigation strategies, and are well informed regarding security topics which may be complex in nature.
Provides business-oriented cybersecurity reporting to executive leadership and the Board, linking security risk to financial exposure, operational continuity, customer trust, regulatory obligations, and investment priorities.
Leads cybersecurity readiness for operating requirements, including Board reporting, disclosure escalation, evidence management, cyber materiality processes, and audit ready controls.
Leads US Securities and Exchange Commission (SEC) cybersecurity disclosure readiness, including incident classification, materiality escalation, legal coordination, executive decision support, disclosure documentation, and post-incident lessons learned.
Develops and uses metrics to drive decisions that optimize budgeting within the operating environment.
Executes security initiatives in a multi-subsidiary environment with varied requirements ensuring timely and successful implementations are achieved.
Partners with business and technology leaders to secure operationally critical platforms, including eCommerce, supply chain systems, procurement, branch systems, analytics, cloud platforms, engineering networks, customer identity, and AI-enabled capabilities.
Assesses and modifies procedures to ensure the safety of information systems assets and to protect systems from intentional or inadvertent access, modification or destruction.
Conducts security risk assessments on new products and systems, periodic security risk assessments on existing systems and identifies and/or recommends appropriate security countermeasures and best practices.
Develops and tests enterprise cyber resilience capabilities, including ransomware readiness, crisis communications, tabletop exercises, disaster recovery alignment, minimum viable business planning, and recovery expectations for critical platforms.
Defines and governs security requirements for AI-enabled capabilities, including acceptable use, data leakage prevention, model and vendor risk, identity controls, monitoring, and secure use of AI agents and automation.
Coordinates activities or engagements with data loss prevention, and interacts with legal and law enforcement as required.
Drives modernization of identity and access controls, including privileged access, customer identity, application onboarding, orphaned account remediation, entitlement governance, access certification, and least-privilege operations.
Defines security expectations for M&A diligence and integration, including control baselines, network segmentation, endpoint protection, access governance, vulnerability remediation, third-party risk, and post-close accountability.
Builds a measurable third-party and supply-chain security program covering vendor due diligence, contractual security requirements, breach notification obligations, ongoing monitoring, software supply-chain risk, and remediation accountability.
Supports customer and commercial security requirements, including digital commerce trust, customer security reviews, contractual cyber obligations, and security capabilities needed to enable revenue growth.
Develops and maintains centralized information systems security standards, procedures, and guidelines.
Manages all IT compliance activities globally (e.g. SOX, PCI, GDPR, and privacy requirements).
Performs other duties as assigned.