Director of Information Security Governance Risk and Compliance

Remote
Full Time
CORP
Senior Manager/Supervisor

DIRECTOR OF INFORMATION SECURITY GOVERNANCE RISK AND COMPLIANCE

Company Overview:

Gulf Copper LLC, a subsidiary of Davie Defense, is a leading Marine Repair and New Construction company based in Galveston, Texas, with more than 75 years of ship repair and fabrication experience on the Gulf Coast. Gulf Copper’s primary business is the repair and refurbishment of marine vessels, ship construction, and fabrication for transportation, government, and oil and gas markets.

Benefits:

  • 401 (k)

  • Group Health & Dental Plan

  • Short-& Long-Term Disability Insurance

  • Life & Voluntary Life Insurance

  • Holiday & Vacation Pay

  • Employee Assistance Program.

Position Summary:

The Director, Information Security Governance, Risk and Compliance leads the organization’s information security governance, cyber and technology risk, security compliance, and assurance programs. Reporting to the CISO, the Director oversees the Information Security Management System, security policies and standards, cyber-risk management, control governance, assessments, customer assurance, and security-related remediation.

The Director establishes a risk-based control and compliance program aligned with applicable requirements and frameworks, including NIST CSF, NIST SP 800-171, CMMC, DFARS, CIS Controls, ISO/IEC 27001, ITAR-related information-protection requirements, and contractual obligations. The role advises executive leadership on material cyber risk, control effectiveness, compliance, and audit readiness.

The position partners with Legal, Contracts, Quality, Supply Chain, Human Resources, Internal Audit, Engineering, Operations, and other business functions. These functions retain ownership of their respective legal, contractual, quality, personnel, operational, and regulatory responsibilities.

Essential Duties and Responsibilities:

This position is responsible for the following: Other duties may be assigned.

Information Security Governance & Cyber Risk Management:

  • Advise the CISO and executive leadership on material cyber risk and compliance.
  • Translate regulatory and contractual security requirements into risk-based business recommendations.
  • Lead the Information Security GRC program and maintain the cyber and technology risk-management framework.
  • Maintain risk registers and integrate material cyber and technology risks into the enterprise risk process.
  • Lead risk assessments, treatment planning, exception management, and executive risk reporting.
  • Develop and govern information security policies, standards, and control requirements.
  • Establish KPIs and KRIs for risk, compliance, control performance, and remediation.
  • Facilitate formal risk acceptance by authorized business and executive risk owners.

Information Security Controls & Compliance:

  • Govern the organization's information security control framework using the Secure Controls Framework (SCF) for control mapping and harmonization.
  • Maintain alignment with applicable requirements, including NIST CSF, NIST SP 800-171, CMMC, CIS Controls, ISO/IEC 27001, DFARS, FAR, ITAR-related information-protection requirements, and applicable privacy requirements.
  • Monitor regulatory and contractual developments and advise leadership on material impacts.
  • Provide security-control oversight supporting privacy, data protection, and Quality Management System requirements.
  • Define control requirements and oversee implementation, while business and technology owners remain accountable for control operation, remediation, and evidence.

Assurance & Customer Compliance:

  • Maintain a risk-based internal security assessment and assurance program.
  • Coordinate security-related external audits, certification assessments, regulatory examinations, and customer reviews.
  • Track findings, control deficiencies, and corrective actions through resolution.
  • Support customer security questionnaires, compliance attestations, and assurance activities.

Incident Management & Investigations:

  • Provide governance oversight for information security and technology incidents, including control-failure analysis, corrective actions, and lessons learned.
  • Lead or support investigations within assigned authority and coordinate with Legal, HR, Privacy, Quality, Safety, and Operations as appropriate.
  • Ensure investigation records and evidence are appropriately preserved.

Security Awareness & Third-Party Risk:

  • Establish Lead information security training and awareness programs.
  • Lead the information security and technology-risk component of third-party risk management in coordination with Supply Chain, Legal, Contracts, IT Operations, and business owners.
  • Define security due-diligence requirements, assess third-party security risks, recommend appropriate controls, and track identified deficiencies.

Required Education & Experience:

Required qualifications:

  • Bachelor’s degree in information security, cybersecurity, risk management, information systems, business, engineering, or a related field, or equivalent relevant experience.
  • At least 10 years of progressively responsible experience in information security governance, cyber risk, compliance, audit, security assurance, or related disciplines, including at least 3 years in a leadership or program-management role.
  • Demonstrated experience developing or operating information security governance, risk, compliance, and assurance programs.
  • Working knowledge of NIST SP 800-171, NIST CSF, CMMC, DFARS cybersecurity requirements, CIS Controls, and ISO/IEC 27001.
  • Experience managing assessments, corrective-action plans, risk registers, executive reporting, and customer security-assurance activities.
  • Demonstrated ability to influence across business and technical functions without relying solely on direct authority.
  • Strong written, analytical, presentation, investigation, and executive-communication skills.

Preferred qualifications:

  • Master’s degree in cybersecurity, information systems, risk management, business administration, or a related field.
  • One or more relevant certifications, such as CISM, CRISC, CISA, CISSP, CGRC, ISO/IEC 27001 Lead Implementer or Lead Auditor, or CIPP.
  • Experience supporting defense-industrial-base, maritime, shipbuilding, manufacturing, critical-infrastructure, or government-contracting environments.
  • Experience with export-controlled information, CUI, government contracting, and customer security requirements.

Working Conditions:

  • Work is primarily performed in a professional office or remote-work environment, with periodic interaction across departments and operational areas. 
  • The position requires extended periods of sitting, computer use, reading, analysis, documentation, and communication with employees, management, customers, auditors, and other business partners. 
  • Occasional visits to shipyard, production, warehouse, or other operational areas may be required. These areas may involve noise, moving equipment, uneven walking surfaces, weather conditions, and other industrial workplace conditions. 
  • Must comply with all applicable safety requirements and wear designated personal protective equipment when entering operational areas. 
  • Business travel may be required on an as-needed basis to support assessments, audits, customer requirements, training, investigations, or company operations. 
  • Occasional work outside normal business hours may be required to support security incidents, investigations, audits, regulatory or customer deadlines, and other time-sensitive matters. 

Necessary Equipment Operation:

  • Computer, laptop, mobile phone, and standard office equipment.
  • Information security governance, risk, compliance, assessment, documentation, reporting, and collaboration systems.
  • Standard personal protective equipment when entering designated operational areas.

Special Skills:

  • Ability to interpret security, regulatory, contractual, and control requirements and translate them into risk-based business recommendations.
  • Strong leadership, executive communication, analytical, presentation, investigation, and cross-functional stakeholder-management skills.
  • Ability to lead governance, risk, compliance, assurance, assessment, remediation, and third-party security-risk activities.
  • Knowledge of NIST CSF, NIST SP 800-171, CMMC, DFARS, FAR, CIS Controls, ISO/IEC 27001, SCF, and ITAR-related information-protection requirements.

*An Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability. Know Your Rights. If you’d like to view a copy of the company’s affirmative action plan or policy statement, please email: [email protected].  If you have a disability and you believe you need a reasonable accommodation in order to search for a job opening or to submit an online application, please e-mail: [email protected].

Share

Apply for this position

Required*
We've received your resume. Click here to update it.
Attach resume or Paste resume
Attach resume as .pdf, .doc, .docx, .odt, .txt, or .rtf (limit 5MB) or Paste resume

Paste your resume here or Attach resume file

To comply with government Equal Employment Opportunity and/or Affirmative Action reporting regulations, we are requesting (but NOT requiring) that you enter this personal data. This information will not be used in connection with any employment decisions, and will be used solely as permitted by state and federal law. Your voluntary cooperation would be appreciated. Learn more.
Invitation for Job Applicants to Self-Identify as a U.S. Veteran
  • A “disabled veteran” is one of the following:
    • a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or
    • a person who was discharged or released from active duty because of a service-connected disability.
  • A “recently separated veteran” means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.
  • An “active duty wartime or campaign badge veteran” means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.
  • An “Armed forces service medal veteran” means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.
Veteran status


Voluntary Self-Identification of Disability
Voluntary Self-Identification of Disability Form CC-305
OMB Control Number 1250-0005
Expires 07/31/2029
Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Please check one of the boxes below:

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.

You must enter your name and date
Human Check*