Principal Information Security Engineer – Governance & Risk

Ferguson

. Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF) .

Posted 11/9/2026full-timeRemote • United StatesLead💰 $10,595 - $18,536 per monthWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading cybersecurity risk assessments using the NIST Cybersecurity Framework, developing security policies, and managing third-party risk. Proficient in translating technical risks into business impact and communicating effectively with diverse stakeholders.

Highest-signal resume keywords

NIST Cybersecurity Framework (CSF)Security Risk AssessmentsThird-Party Risk ManagementCybersecurity GovernanceCISSP

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information SecurityIT Risk ManagementComplianceSecurity PoliciesSecurity Controls EvaluationCybersecurity Risk ManagementCloud SecurityRisk Reporting MethodologiesGovernance ProcessesPerformance Metrics

Soft Skills

Analytical SkillsProblem-SolvingStakeholder ManagementInfluencing SkillsPresentation Skills

Tools & Technologies

Microsoft TechnologiesCloud PlatformsSecurity Reporting SolutionsGRC ProgramsDashboards

Certifications & Qualifications

CISSPCISMCRISCCISAISO 27001 Lead Auditor

Industry Keywords

ISO 27001COBITCOSOIT General ControlsSecurity Awareness Program

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF)
Assess and measure cybersecurity program maturity and identify improvement opportunities
Develop recommendations and remediation plans for security control gaps and risk exposures
Partner with technology and business teams to improve governance and risk management
Support security roadmaps, governance processes, and performance metrics
Coordinate independent security assessments, audits, and risk reviews
Lead security assessments of vendors, suppliers, and technology partners
Review security questionnaires, penetration test reports, SOC reports, and compliance documentation
Identify, assess, and communicate third-party security risks and remediation recommendations
Support contract reviews to incorporate appropriate security requirements
Contribute to Ferguson's Security Awareness Program
Develop dashboards, scorecards, and executive reporting related to cybersecurity risk and program performance
Define and track KRIs, KPIs, and security maturity metrics
Leverage automation and reporting tools across GRC programs
Serve as a trusted advisor and cybersecurity governance and risk management domain expert
Develop risk reporting methodologies translating technical risks into business impact
Partner with business leaders to prioritize remediation based on risk exposure, likelihood, and potential business impact
Support cybersecurity and enterprise risk dashboards and executive reporting
Build relationships with business and technology customers
Communicate security risks, recommendations, and program performance to technical and non-technical audiences
Partner with Information Security, Technology, Internal Audit, Procurement, Legal, Enterprise Risk Management, and business leadership

Requirements

What you’ll need

Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field; equivalent combination of education and experience will be considered
5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines
Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments
Experience developing security policies, standards, and governance processes
Experience supporting audits, compliance initiatives, and third-party risk management programs
Experience presenting findings and recommendations to leadership and business stakeholders
Solid understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls
Knowledge of cybersecurity risk management, security governance, third-party risk management, and compliance frameworks
Ability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors
Experience with Microsoft technologies, cloud platforms, and security reporting solutions
Preferred certifications: CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer
Strong analytical, problem-solving, critical thinking, stakeholder management, influencing, written, verbal, and presentation skills
Ability to lead sophisticated initiatives and drive outcomes through collaboration and influence

Benefits

Comp & perks

Health insurance
Dental insurance
Vision insurance
Paid time off
Life insurance
401(k) with a company match
Mental health coverage
Gender affirming benefits
Family building benefits
Paid parental leave
Associate discounts
Community involvement opportunities
Bonus or Incentive Plan eligibility