Cyber Risk & Compliance Analyst

At DuPont, our purpose is to empower the world with essential innovations to thrive. We work on things that matter. Whether it’s providing clean water to more than a billion people on the planet, producing materials that are essential in everyday technology devices from smartphones to electric vehicles, or protecting workers around the world. Discover the many reasons the world’s most talented people are choosing to work at DuPont. Why Join Us | DuPont Careers

Position Overview

The Senior IT Compliance Specialist is a hands-on, globally oriented role responsible for translating regulatory, customer, and internal security requirements into sustainable controls, defensible evidence, and audit-ready operations. The position partners across security, legal, business, support, engineering, infrastructure, and cloud teams to advance compliance outcomes without creating unnecessary operational friction.

This role is designed for an experienced practitioner who can independently lead workstreams, influence control owners, communicate with auditors and customers, and improve the way compliance work is scoped, documented, monitored, and automated.

Role mandate  Make compliance executable: clarify scope and ownership, design practical controls, maintain evidence, anticipate change, and keep priority programs ready for assessment throughout the year.

Key Responsibilities

Compliance leadership and program delivery

- Lead and manage IT compliance initiatives to ensure adherence to internal policies, standards, contractual obligations, and applicable international or government security frameworks.

- Own assigned workstreams from requirement intake and scoping through control mapping, gap assessment, remediation, evidence readiness, and ongoing governance.

- Maintain compliance strategies, roadmaps, and operating plans that align security requirements with business priorities, technology architecture, and delivery commitments.

- Establish clear accountability with business owners, IT asset owners, and control owners; track decisions, risks, dependencies, and remediation commitments to closure.

Assessments, certifications, and audit readiness

- Drive certification and assurance efforts by coordinating internal audits, external assessments, customer reviews, risk assessments, and security documentation submissions.

- Plan and facilitate readiness activities for ISO 27001, NIST SP 800-171, CMMC, TISAX, NIS2, and other requirements assigned to the team.

- Coordinate requests with assessors and third-party auditors, validate the completeness and quality of evidence, and ensure responses are accurate, consistent, and traceable.

- Manage findings and corrective actions using a risk-based approach, including root-cause analysis, remediation planning, validation, exception handling, and status reporting.

- Promote continuous readiness by defining evidence expectations, review cadences, health indicators, and escalation paths rather than relying on point-in-time audit preparation.

Control design, implementation, and monitoring

- Interpret framework and regulatory requirements and translate them into clear, testable control objectives, control activities, evidence requirements, and ownership models.

- Partner with engineering, infrastructure, application, cloud, security operations, identity, data, and support teams to embed controls into technology processes and system lifecycles.

- Assess control design and operating effectiveness, identify gaps or duplicated effort, and recommend practical remediation that balances risk, compliance, and operational needs.

- Support continuous monitoring through defined metrics, automated evidence collection, exception reporting, and periodic control reviews.

- Contribute to reusable control mappings and a unified control approach to reduce duplication across overlapping frameworks and customer obligations.

Documentation and stakeholder support

- Maintain and enhance System Security Plans (SSPs), Information Security Management System, policies, standards, procedures, control narratives, risk assessments, plans of action, evidence repositories, and governance records.

- Serve as a subject matter expert on IT compliance, advising internal teams on scope, control expectations, audit evidence, risk treatment, and compliance-by-design.

- Support customers, contracting stakeholders, and Authorizing Officials (AOs) by providing approved compliance documentation and clear guidance for security evaluations.

- Prepare concise status reports, risk statements, decision materials, and executive updates that distinguish confirmed facts, open issues, ownership, and required action.

- Develop practical guidance and targeted training for control owners and technical teams to improve execution quality and audit readiness.

Regulatory intelligence and process improvement

- Coordinate with Legal, Privacy, Procurement, Internal Audit, Security, and business stakeholders to validate interpretations and convert changes into actionable implementation plans.

- Identify opportunities to automate recurring compliance activities, streamline evidence collection, improve workflow quality, and reduce manual or duplicative work.

- Use lessons learned, audit results, metrics, and stakeholder feedback to improve control design, documentation quality, governance, and team operating practices.

- Perform other responsibilities or special assignments as requested by leadership.

Required Qualifications

- 5–10 years of relevant experience in IT compliance, IT audit, cybersecurity governance, technology risk, or a closely related discipline.

- Demonstrated experience leading compliance assessments, audits, certifications, or regulatory readiness efforts in a complex, multinational technology environment.

- Working knowledge of several of the following: ISO 27001/27002, NIST SP 800-171, CMMC, TISAX, NIS2, NIST Cybersecurity Framework, SOC reporting, IT general controls, or comparable security frameworks.

- Experience translating requirements into control designs, test procedures, evidence expectations, risk statements, and remediation plans.

- Experience creating or maintaining compliance documentation such as SSPs, policies, standards, procedures, control narratives, risk assessments, and audit evidence packages.

- Ability to manage multiple workstreams, organize complex information, meet deadlines, and escalate material risks or dependencies with sound judgment.

- Strong written and verbal English communication skills, including the ability to work effectively across cultures, functions, technical disciplines, and time zones.

- Bachelor’s degree in information systems, cybersecurity, computer science, accounting, risk management, business, or a related field, or equivalent relevant experience.

Preferred Qualifications

- Relevant certification such as CISA, CRISC, CISSP, ISO 27001 Lead Implementer or Lead Auditor, CISM, or a comparable credential.

- Experience supporting cloud or hybrid environments, regulated data, government contracting obligations, automotive assurance, or European cybersecurity requirements.

- Experience with governance, risk, and compliance platforms; workflow automation; data visualization; scripting; or automated evidence collection.

- Familiarity with third-party risk, privacy, Responsible AI governance, mergers and acquisitions, or customer security assurance.

- Experience supporting distributed teams through clear documentation, structured handoffs, measurable service expectations, and overlapping working hours when required.

Indicators of Success

- Assigned compliance obligations are clearly scoped, mapped to accountable owners, and supported by current documentation.

- Assessments and audits are executed with timely, accurate, and traceable evidence and minimal avoidable rework.

- Control gaps, risks, exceptions, and remediation actions are transparent, risk-prioritized, and progressed to closure.

- Compliance requirements are embedded earlier in technology, sourcing, and change decisions.

- Recurring work becomes more standardized, measurable, automated, and sustainable across the global delivery model.

Work Style and Collaboration Expectations

The successful candidate is proactive, structured, pragmatic, and comfortable operating with a high degree of independence. Because the role supports global stakeholders, the individual must be able to manage priorities across time zones, document decisions and handoffs clearly, protect confidential information, and maintain dependable communication during agreed collaboration windows. Occasional schedule flexibility may be required for audits, customer discussions, incidents, or regulatory deadlines.

Join our Talent Community to stay connected with us!

DuPont is an equal opportunity employer. Qualified applicants will be considered without regard to race, color, religion, creed, sex, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability or any other protected class. If you need a reasonable accommodation to search or apply for a position, please visit our   Accessibility Page for Contact Information .

DuPont offers a comprehensive pay and benefits package. To learn more visit the Compensation and Benefits page .