IT Governance, Risk & Compliance Analyst
- Location
- Houston, TX
- Work mode
- On-site
- Employment type
- Full-time
About the job
At OxyChem, our chemistry makes modern life possible, and it is our people who make the difference. We are a safety-first, purpose-driven team committed to innovation, environmental responsibility, and doing things the right way. If you are ready to contribute, elevate your skills, and take ownership of your career, Oxychem offers the opportunity to make a difference every day.
OxyChem, a Berkshire Hathaway company, is a leading producer of essential chemistry with operations in the U.S., Canada and Latin America. OxyChem’s products play an essential role in everyday life, supporting critical applications in water treatment, pharmaceuticals, healthcare, manufacturing, automotive, personal hygiene, and residential and commercial construction. OxyChem actively participates in the Occupational Safety and Health Administration Voluntary Protection Program, underscoring our commitment to safety. Headquartered in Dallas, Texas, OxyChem is a top three U.S. manufacturer of polyvinyl chloride, chlor-alkali and chlorinated organic chemicals, and calcium chloride. Visit oxychem.com for more information.
In a fast-paced industry that demands precision, we create a supportive workplace where the safety and well-being of our employees are paramount. We are committed to rewarding top performers, offering very competitive pay and benefits, and providing tremendous career development opportunities.
OxyChem is seeking a mid-level IT Governance, Risk & Compliance (GRC) Analyst to support cybersecurity governance, risk management, compliance, audit readiness, and security awareness efforts. Working with guidance from senior team members, this role will partner with IT, Internal Audit, Legal, Compliance, Human Resources, and business stakeholders to identify, assess, track, and communicate cybersecurity risks across the enterprise.
Key Responsibilities:
Governance, Risk & Compliance
- Support the implementation and ongoing maintenance of cybersecurity governance, risk management, and compliance processes aligned with business objectives and established standards.
- Perform IT and business risk assessments, document results, and maintain risk registers using frameworks such as the NIST Cybersecurity Framework and ISO 27001.
- Track remediation activities, corrective action plans, and control gaps, following up with owners and escalating overdue items as appropriate.
- Support internal and external cybersecurity audits, assessments, and compliance reviews by coordinating evidence collection, documentation, responses, and status tracking.
- Help evaluate compliance with applicable regulatory, contractual, and cybersecurity requirements, including MTSA, GDPR, and relevant industry standards.
- Review cybersecurity requirements in contracts, vendor agreements, exception requests, and compensating-control documentation with oversight from senior team members.
- Collect, validate, and report Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), compliance metrics, and remediation progress.
- Assist with the development and maintenance of cybersecurity policies, standards, procedures, and guidelines.
- Support periodic risk reviews and third-party cybersecurity risk management activities.
IT Audit & Compliance Management
- Serve as a day-to-day point of contact for audit evidence requests and compliance documentation under the direction of senior GRC leadership.
- Test and assess control design and operation using established procedures, documenting observations and identifying opportunities for improvement.
- Support cybersecurity maturity assessments, benchmarking activities, and continuous audit-readiness efforts.
- Prepare clear management reporting on compliance status, audit findings, remediation progress, and cybersecurity risks.
Security Awareness & Culture
- Coordinate and enhance cybersecurity awareness activities, including phishing simulations, campaigns, newsletters, training, and targeted education.
- Maintain metrics and reporting to evaluate awareness-program participation and effectiveness.
- Partner with Human Resources, Communications, and business stakeholders to deliver consistent cybersecurity messaging.
- Assist with the development of presentations, briefings, and educational materials for employees and managers.
- Identify practical opportunities to improve employee engagement and reduce human-related cybersecurity risk.
Technical & Operational Support
- Monitor relevant government and industry cybersecurity advisories and summarize potential business impacts for review.
- Coordinate logistics and follow-up activities for cybersecurity assessments, maturity reviews, vulnerability assessments, and penetration testing.
- Support relationships with cybersecurity service providers, assessment partners, and third-party risk vendors.
- Partner with infrastructure, application, cloud, and engineering teams to document security-control implementation and remediation status.
- Assist with risk reviews involving cloud services, artificial intelligence, and digital-transformation initiatives.
- Participate in cybersecurity incident reviews, lessons-learned discussions, and risk-based remediation tracking.
Required Qualifications:
- Bachelor's degree in Cyber Security, Information Systems, Computer Science, Engineering, Finance, or a related field, or equivalent relevant experience.
- 3-5 years of experience in cybersecurity, governance, risk, compliance, information security, audit, privacy, or third-party risk management.
- Hands-on experience supporting risk assessments, audits, compliance reviews, control testing, or remediation tracking.
- Experience working with GRC, audit-management, vendor-risk-management, ticketing, or workflow tools.
- Experience maintaining policies, control documentation, audit evidence, risk records, or corrective action plans.
- Strong organizational and project-coordination skills, including the ability to manage multiple priorities and follow through on commitments.
- Clear written and verbal communication skills, with the ability to explain risk and compliance requirements to both technical and non-technical audiences.
- Ability to work collaboratively across business and technology teams.
- Ability to travel up to 20%.
Preferred Qualifications:
- Working knowledge of the NIST Cybersecurity Framework, ISO 27001, or similar control frameworks.
- Experience in a regulated, industrial, manufacturing, or operational technology environment.
- One relevant certification, or progress toward certification, such as CISA, CRISC, CISM, CGRC, Security+, CISSP, ISO 27001, CDPSE, CIPM, CIPP/US, or CIPP/E.
Fraud Statement:
It has come to our attention that various individuals and/or organizations are contacting people falsely pretending to recruit on behalf of OxyChem. Please be aware that these recruiting scams and communications do not originate, nor are they associated with our recruitment process. All OxyChem job postings and offers will require a completed application through our company website. OxyChem does not charge a fee at any stage of the recruiting process. We will never: • Ask you to pay for applications, interviews, meetings, processing, training or for any other fees • Use recruiting or placement agencies that charge candidates an advance fee of any kind or • Request personal information such as passport and bank account details at an early stage of our recruitment process.
We recommend against responding to unsolicited business propositions or offers from people you don't know. Do not disclose your personal or financial details. If you believe you have been the victim of a recruiting scam, please contact your local police department.
From OC2 Occidental Chemical Corporation's careers page (Workday), checked 30 Oct 2026.
How to apply
- Select Apply on oxychem.wd504.myworkdayjobs.com. It opens OC2 Occidental Chemical Corporation's own application form in a new tab, run on Workday.
- Fill in the form and upload your résumé there. Jobiwork never sees your application.
- OC2 Occidental Chemical Corporation will reply to you directly. No real employer asks you for money to apply.
Posted 29 Oct 2026 · checked 30 Oct 2026 · Report this job