Information Security & Data Governance Lead (US)

Job Description

Job DescriptionSalary:

Principal Accountabilities
Information Security
Develop, implement, and maintain information and cyber security policies, standards, and procedures
Ensure alignment with recognized frameworks (ISO 27001, NIST CSF, CIS Controls)
Conduct risk assessments across IT, cloud, and Operational Technology (OT) environments
Support incident response planning and continuous improvement of security controls
Embed secure-by-design principles into infrastructure and operational systems
Data Governance
Establish and maintain an enterprise data governance framework
Define and enforce data classification, handling, retention, and protection standards
Ensure compliance with international data protection regulations including GDPR, UK Data Protection Act, and applicable US privacy laws
Promote data ownership, stewardship, and accountability across business units
Support data quality, integrity, and lifecycle management
Compliance & Regulatory Oversight
Ensure compliance with applicable cybersecurity, data governance, and energy sector regulations
Lead and support internal and external audit activities, including evidence collection and remediation tracking
Maintain enterprise risk registers and compliance reporting
Continuously monitor global cyber and data regulatory changes
Assess impact of regulatory developments and update internal policies, standards, and procedures accordingly
Ensure compliance is maintained across all regions of operation
Cybersecurity Awareness & Training
Design and deliver enterprise cybersecurity awareness programmes
Conduct phishing simulations and risk-based awareness campaigns
Tailor training for corporate and operational (OT) environments
Measure effectiveness and drive continuous improvement in user behaviour
Governance & Advisory
Act as subject matter expert and advisor on security, governance, and compliance matters
Administer and support third-party/vendor risk management programme
Provide reporting and insights to leadership on security posture, regulatory changes, and risk exposure
Contribute to the continuous improvement of governance, risk, and compliance (GRC) capability
Member of change management board and contributor to change management process
Qualifications and Experience
Required
Significant experience in information security, cybersecurity GRC, or IT governance roles
Proven experience implementing data governance frameworks
Strong understanding of international data protection and cybersecurity regulations
JOB DESCRIPTION
Experience working within regulated environments
Familiarity with ISO 27001, NIST, or equivalent frameworks
Experience supporting audit and compliance processes
Desired
Experience in the energy, utilities, or critical infrastructure sector
Exposure to Operational Technology (OT) environments
Professional certifications (e.g., CISSP, CISM, CRISC, CISA, CDMP)
Experience with GRC tools (e.g., ServiceNow GRC, RSA Archer, MetricStream)
HSE Responsibilities
Stop work by challenging and stopping unsafe acts and behaviours or unsafe conditions.
Comply with Standard Operating Procedures defined in Responsibilities above, and company STOP WORK
system.
Ensure that cybersecurity considerations support safe and reliable operational environments, particularly
within OT systems
Competencies
Risk & Compliance Expertise: Strong understanding of regulatory and governance frameworks
Analytical Thinking: Ability to assess and mitigate complex risks
Stakeholder Engagement: Ability to influence across technical and business teams
Communication: Clear communication of technical and regulatory requirements
Autonomy: Operates independently with accountability for outcomes
Continuous Improvement: Proactively adapts to changing regulatory and threat landscapes
Any Other Information
This is a senior individual contributor role with no direct reports
The role operates across multiple jurisdictions with varying regulatory requirements