Job description
Tenneco is one of the world’s leading designers, manufacturers and marketers of automotive products for original equipment and aftermarket customers, with 2019 revenues of $17.5 billion and approximately 78,000 team members working at more than 300 sites worldwide.
Tenneco is looking for a director governance, risk management & complianceAs a governance, risk management, and compliance (grc) director, you will be responsible for the overall enterprise-wide grc programsIn this role, you will be responsible for the hands-on design, implementation, and effective management of the programs and the shaping of the security policies, standards, and procedures aligned with the overall cybersecurity strategy and programsYou will provide subject matter expertise and leadership on mature security governance structures and processes, risk management process, and contractual, regulatory compliance requirementsThis role requires a combination of a strong grc background and business acumen to manage relationships between the various business units and it groups.
The team is ready to act immediately on those candidates who are the best fit for the roleYou’ll first hear from someone in talent acquisition to schedule a phone screen, and then the next step will be a personal interview with our hiring managerWe pride ourselves on moving through processes quickly, and you can be sure of transparency and prompt communication throughout.
Responsibilities:
Governance: you will be responsible for designing and leading a comprehensive governance program, including the establishment of security policies, standards, and procedures by taking a risk-based approach with the program designYou will be using the nist 800-53, 800-171, and iso 27001 requirements as a guide in the program designYou will be work cooperatively with others and solicit input from the various areas of the organizationYou will be implementing and managing the governance processes and educating and training the organization on the new governance programs and measuring and reporting on all aspects of the programs.
Risk management: you will be accountable for designing a comprehensive cybersecurity risk management program to identify, quantify, classify and manage risks for the organization and working cooperatively with others and solicit input from the various areas of the organization and continually educating and training the organization on the new risk management function and how they can participate and contribute to itDriving the identification of security risks and maintaining a risk register, including planned mitigations and acceptanceThe risk management program will include a vendor risk management function including working closely with the procurement team and others to evaluate and report on vendors’ risk and measuring and reporting on all identified risks and the overall security risk management functionsYou will also be aligning security risk management with the existing business risk management practices.
Compliance: you will be designing a comprehensive compliance program, including the establishment of security policies, standards, and proceduresTaking a risk-based approach to ensure the new program design satisfies the it business functions as well as the commercial lines of businessYou will be using the data and privacy requirements like gdpr, and ccpa as a guide in the program designContinually evaluating and reporting on the controls design, implementation, effectiveness, and maturity levels and working cooperatively with others and solicit input from the various areas of the organizationGuiding, educating, and advocating the organization on the compliance requirements and how each person and department play a role in maintaining the required compliance and measuring and reporting on all aspects of the compliance program.
Leadership: you will be serving as the primary subject matter expert and leader on all aspects of compliance, governance, and risk managementProviding regular reports to the chief information security officer (ciso) and, when needed to other internal or external entities on all aspects of this role responsibilities, including adequate metrics on each of the programsYou will be serving as the primary security liaison for internal and external audits and as needed to represent it and security and respond to inquiries from external entities on all matters related to security complianceYou will be making independent decisions or representing leadership at timesOwn third-party risk evaluation process and any required audits to demonstrate our risk posture and control adherence and manage grc technology, staffing needs, and manage assigned budget in line with approved allocationsMentor and manage others to increase team competency and continually build a culture of constant improvement and a desire to excel.
Required experience
Education: bachelor’s degree in computer science, risk management, or equivalent education and related extensive experience
Skills & experience:
Experience in building and managing compliance and risk management programs, including hands-on control design and effectiveness evaluation.
Strong knowledge and experience in security requirements, standards, and best practices, including nist csf, iso 27001, owasp.
Background in developing and maintaining security policies, processes, procedures, and standards.
Knowledge of and prior experience in grc tools/ technologies.
Excellent written and verbal communication skills.
Ability to manage across multiple competing priorities and time-sensitive initiatives.
Strong ability to motivate and lead team members, including in a remote/distributed workforce• uncompromising personal and professional integrity and ethics.
One or more relevant industry-standard security certifications (such as cissp, crisc, or cism)
Ability to travel up to 25% of the time.
An equal opportunity employerAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability.
