Lead, Cybersecurity Risk and Compliance

Requisition ID:  300786

- Relocation Authorized:  None
- Telework Type: Part-Time Telework
- Work Location: Reston, VA
- Salary Range: $123,400 - $203,700 annually (salary range is based on market data; final salary offered is determined by education, experience, and qualifications of the applicant.)

## Extraordinary teams building inspiring projects:

Since 1898, we have helped customers complete more than 25,000 projects in 160 countries on all seven continents that have created jobs, grown economies, improved the resiliency of the world's infrastructure, increased access to energy, resources, and vital services, and made the world a safer, cleaner place.

Differentiated by the quality of our people and our relentless drive to deliver the most successful outcomes, we align our capabilities to our customers' objectives to create a lasting positive impact. We serve the Infrastructure; Nuclear, Security & Environmental; Energy; Mining & Metals, and the Manufacturing and Technology markets. Our services span from initial planning and investment, through start-up and operations.

Core to Bechtel is our Vision, Values and Commitments . They are what we believe, what customers can expect, and how we deliver. Learn more about our extraordinary teams building inspiring projects in our Impact Report .

## Project Overview:

Please use this field to provide any standard language being used externally to describe the project (typically the first few sentences used to describe the project on the http://bechtel.com website or in press releases) . If no overview is available, please remove this section and Talent Acquisition will add a general description for the GBU.

## Job Summary:

In this role, you will participate in the development and execution of risk assessments, compliance monitoring, and an enterprise-wide cyber security and awareness program. You will identify gaps in policy and controls, lead policy development, and participate in global remediation efforts. Your work will ensure effectively deployed programs and well-informed, engaged employees.  #LI-TN1

## Major Responsibilities:

Cybersecurity Risk Program Leadership

- Lead enterprise cybersecurity risk management activities, including risk assessments, security exception evaluations, risk documentation, mitigation planning, and continuous monitoring of emerging threats, technology changes, regulatory developments, risk trends to drive risk-informed decisions, control improvements, and program priorities.
- Build trusted relationships across Cybersecurity, IT, Legal, Compliance, Architecture, Operations, Software Development, projects, service owners, and business units to embed risk-informed decision-making and create shared accountability for risk treatment.
- Serve as a cybersecurity risk thought leader and trusted advisor; lead cross-functional working sessions, align stakeholders on priorities and requirements, resolve issues, and drive decisions and deliverables with limited direction.
- Establish and continually improve program processes, roles, decision points, and quality expectations that enable consistent identification, assessment, treatment, acceptance, monitoring, and closure of cybersecurity risk.
- Provide work leadership, coaching, and mentoring; review work products and promote consistent, high-quality risk practices.

Metrics, Reporting, ServiceNow, and AI Enablement

- Lead the evolution of the cybersecurity risk management program by prioritizing risk treatment activities, delivering meaningful metrics, reporting, and insights that enable business leaders and stakeholders to make informed decisions, improve risk posture, and advance program maturity.
- Partner with ServiceNow product owners, developers, administrators, and process stakeholders to clarify requirements, prioritize enhancements, validate delivered functionality, improve data quality, and support adoption of standardized risk workflows.
- Define and document business, functional, workflow, data, reporting, and control requirements for the ServiceNow development team supporting cybersecurity risk and GRC capabilities.
- Identify and apply approved artificial intelligence, automation, and analytics capabilities to streamline risk processes, improve data analysis, enhance reporting, and advance the maturity and effectiveness of the program.
- Prepare polished reports, presentations, and decision materials that provide stakeholders with a clear view of cybersecurity risk, business impact, treatment status, and required actions.

## Education and Experience Requirements:

Level 1: Typically requires bachelor's degree (or international equivalent) and 8-10  years of relevant experience or 12-14 years of relevant work experience.

Level 2:   Typically requires bachelor's degree (or international equivalent) and 10 - 13  years of relevant experience or 14-17 years of relevant work experience.

## Required Knowledge and Skills:
 
- Experience establishing, maturing, or leading cybersecurity risk management programs, including risk governance, risk assessment methodologies, risk registers, exception management, risk treatment processes, and executive-level reporting.
- Strong knowledge of relevant frameworks and requirements, such as ISO 27001, NIST, CIS, PCI, SOX, FedRAMP, GDPR, as applicable to assigned work.
- Broad understanding of cybersecurity and technology risk across commercial and government cloud services, on-premises infrastructure, applications, identity, endpoints, data, and third parties.
- Ability to assess complex and ambiguous issues, evaluate variable factors, exercise independent judgment, and develop practical, risk-based recommendations.
- Proven ability to translate technical concepts and risk information into plain language, polished deliverables, and clear recommendations for decision makers.
- Demonstrated ability to lead cross-functional efforts, facilitate difficult discussions, influence without direct authority, and drive work to completion.
- Experience with ServiceNow GRC and analytics tools such as Power BI, Tableau, or equivalent platforms.
- Ability to identify and responsibly apply approved artificial intelligence and automation capabilities to improve risk processes, analysis, and reporting.
- Ability to work independently, adapt quickly, and manage multiple high-priority initiatives in structured and unstructured environments.

Preferred Qualifications

- Experience designing, implementing, or enhancing ServiceNow IRM/GRC capabilities, workflows, integrations, reporting, dashboards, data models, and roadmap initiatives.
- Familiarity with Agile, Scrum, product-management, and continuous-improvement practices used to deliver cybersecurity capabilities, workflows, and technology enhancements.

## Total Rewards/Benefits:

For decades, Bechtel has worked to inspire the next generation of employees and beyond! Because our teams face some of the world's toughest challenges, we offer robust benefits to ensure our people thrive.  Whether it is advancing careers, delivering programs to enhance our culture, or providing time to recharge, Bechtel has the benefits to build a legacy of sustainable growth. Learn more at Bechtel Total Rewards

## Diverse teams build the extraordinary:

As a global company, Bechtel has long been home to a vibrant multitude of nationalities, cultures, ethnicities, and life experiences. This diversity has made us a more trusted partner, more effective problem solvers and innovators, and a more attractive destination for leading talent.

We are committed to being a company where every colleague feels that they belong-where colleagues feel part of "One Team," respected and rewarded for what they bring, supported in pursuing their goals, invested in our values and purpose, and treated equitably. Click here to learn more about the people who power our legacy.

At Bechtel, our employees enjoy a competitive total rewards package that includes comprehensive medical, dental, and vision plans, along with optional disability and supplemental insurance options, generous paid time off (160 hours annually, accrued 6.16 hours per pay period), nine paid holidays, paid parental leave, discretionary bonuses, and a well-designed 401K plan with matching and profit-sharing components

Bechtel is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity and expression, age, national origin, disability, citizenship status (except as authorized by law), protected veteran status, genetic information, and any other characteristic protected by federal, state or local law. Applicants with a disability, who require a reasonable accommodation for any part of the application or hiring process, may e-mail their request to  [email protected]