IT GRC Lead

At Valvoline Global Operations, we're proud to be The Original Motor Oil, but we've never rested on being first. Founded in 1866, we introduced the world's first branded motor oil, staking our claim as a pioneer in the automotive and industrial solutions industry. Today, as an affiliate of Aramco, one of the world's largest integrated energy and chemicals companies, we are driven by innovation and committed to creating sustainable solutions for a better future.

The Sr. GRC Analyst supports Valvoline Global's IT Governance, Risk, and Compliance (GRC) function by advancing governance, data protection, and information security initiatives. Key responsibilities include conducting information security risk and control assessments, supporting security awareness and information security maturity activities, assisting with audits, and operationalizing systems to monitor and ensure regulatory requirements and industry best practices.

Job Accountabilities

• Execute the company's cyber risk assessment and cyber security compliance programs. Lead risk assessment engagements to capture and measure cyber security risks, identify risk owners, and develop mitigation plans. Monitor cyber security risks by continuous re-assessment according to risk level.
• Maintain the company's IT General Control (ITGC) framework. Lead consulting engagements to identify key controls, document control processes, and establish audit evidence requirements.
• Drive efforts to improve IT maturity and effectiveness of internal controls through process improvement initiatives and automation to enhance control maturity.
• Report on metrics measured by the NIST CSF and C2M2 based Aramco maturity frameworks. Provide guidance to business units on compliance requirements, industry standards, and emerging risks for information systems.
• Improve user acceptance, maturity and implementation of IT-GRC systems such as Service Now IRM, KnowBe4, Jira and other new and emerging technology solutions.

Job Qualifications / Education / Skills / Requirements / Capabilities

• Five or more years of experience in IT or enterprise risk management, IT or operational audit, or a related field demonstrating knowledge of third-party risk, privacy, information security, compliance requirements, and control implementation.
• Knowledge of the NIST CSF and C2M2 maturity frameworks and relevant assessment practices.
• Experience assessing risk, control design and control effectiveness for IT and operational controls.
• Competence in managing audit requests, writing narratives, documenting & submitting evidence and following up.
• Experience contributing to complex projects that include stakeholders from multiple business processes.
• Ability to own your own workflow and manage multiple priorities.

Competencies Desired

• ServiceNow GRC modules: Integrated Risk Management, Third-Party Risk Management and/or Privacy Management.
• Jira Cloud project management software.
• NIST Cybersecurity Framework 1.1 and/or 2.0, and the Cybersecurity Capability Maturity Model for OT systems (C2M2).
• Strong collaboration and communication skills and the ability to engage effectively with peers and leadership.
• Data analytics, reporting and presenting metrics to leadership.