Principal Information Security Engineer - Governance & Risk (Remote)
Job Posting:
Since 1953, Ferguson has been a source of quality supplies for a variety of industries. Together We Build Better infrastructure, better homes and better businesses. We exist to make our customers’ complex projects simple, successful, and sustainable. We proactively solve problems, adapt and grow to continuously serve our customers, communities and each other. Ferguson, a Fortune 500 company, is proud to provide best-in-class products, service and capabilities across the following industries: Commercial/Mechanical, Facilities Supply, Fire and Fabrication, HVAC, Industrial, Residential Trade, Residential Building and Remodel, Waterworks and Residential Digital Commerce. Ferguson has approximately 36,000 associates across 1,700 locations. Ferguson is a community of proud associates who operate with the shared purpose of building something meaningful. You will build a career that you are proud of, at a company you can believe in.
Principal Information Security Engineer – Governance & Risk
---------------------------------------------------------------
The Principal Information Security Engineer – IT Governance & Risk plays a key role in advancing Ferguson’s enterprise cybersecurity risk and governance strategy. This highly visible position leads several critical security programs, including Third-Party Risk Assessment (TPRA), NIST Cybersecurity Framework (CSF) transformation, external security posture management, and cybersecurity risk oversight.
As a senior cybersecurity subject matter expert, this role will drive the continued evolution of Ferguson’s third-party risk program, modernizing assessment processes to improve efficiency, scalability, business customer engagement, and risk-based decision-making. The Principal Engineer will also lead efforts to mature Ferguson’s adoption of the NIST CSF, establishing sustainable governance and measurement practices that align cybersecurity capabilities with enterprise risk and business priorities.
The role also provides strategic oversight of Ferguson’s external security posture and cyber exposure, including BitSight security ratings, continuous third-party monitoring, attack surface visibility, remediation tracking, and executive-level reporting. In addition, this position leads cybersecurity support for Ferguson’s annual cyber insurance renewal, partnering with Risk Management, Legal, and executive leadership to demonstrate control effectiveness, assess readiness against underwriting requirements, and strengthen the organization’s overall risk posture.
Working across Information Security, Technology, Internal Audit, Procurement, Legal, Enterp...
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis.