GENERAL DESCRIPTION OF POSITION
The Manager Governance, Risk Management, and Compliance (GRC) & Security will be part of Murphy USA Cyber risk and compliance team and will work closely with Business, SOX, PCI and Compliance team(s) to implement industry best practices, and establish internal standards in GRC & Security domain. The Manager GRC & Security will be responsible for identifying and mitigating IT control gaps and partnering with business, product & engineering teams on remediation items. This position will partner with business, product, engineering, data, and technology teams to integrate appropriate governance, security, privacy, human oversight, and control requirements throughout the technology and AI lifecycle.
ESSENTIAL DUTIES AND RESPONSIBILITIES
- This individual will work closely with functional, business and audit teams to gather security requirements, design and implement security solutions, in compliance with Security, regulatory, organizational PCI and SOX controls.
- Manage & work with Murphy USA vendors on on-going security role and authorization changes to meet business and security compliance requirements.
- Plan, lead and execute the company’s IT SOX program including performing risk assessments, leading walk throughs and overseeing tests of design and operational effectiveness of IT controls
- Participate in annual and ongoing SOX scoping to identify any changes to the systems, applications, and automated controls considered to be in-scope for the current fiscal year
- Participate in annual and ongoing PCI certification and identify any changes to the systems, applications, and automated controls considered to be in-scope
- Monitor management’s remediation efforts to closure, including review of supporting evidence.
- Evaluate processes for design deficiencies, identify areas of potential improvements and suggest controls to mitigate identified risks.
- Review new processes from a control’s perspective. Work closely with process owners to design and implement new controls.
- Assist with annual SOX 404 testing with internal and external auditors, including walkthroughs and test of controls, including IT General Controls, provide support on IT Application Controls, and Key Reports.
- Lead and manage Murphy USA's Third-Party Risk Management (TPRM) program, conducting assessments with vendors, reporting and working with vendor business, legal and procurement.
- Conduct security reviews of Master Service Agreements (MSA), Statements of Work (SOW), Non-Disclosure Agreements (NDA), and technology contracts.
- Oversee risk register for tracking, remediation, and reporting.
- Manage a team of compliance analysts to accomplish duties and responsibilities as listed
- Oversee performance and objective setting, reporting, and classification
- Assist in establishing and maintaining an enterprise AI governance framework including policy, standards, control expectations, approval requirements, and accountability across the AI lifecycle.
- Lead or coordinate AI use case intake and risk assessments for acquired, embedded, and generative AI solutions.
- Help coordinate risk-based AI review pathways for low, medium, and high risk use cases and assist business, legal, privacy, security, and AT counsel for executive review as required.
- Support enterprise data governance initiatives including data classification, data handling standards, retention requirements, and data protection controls.
- Assist with implementation and monitoring of data governance controls and regulatory requirements.
QUALIFICATIONS
To perform this job successfully, an individual must be able to perform each essential duty mentioned satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required.
EDUCATION AND EXPERIENCE
- BS/BA degree in related discipline and seven years of related experience; or,
- MS/MA degree in related discipline and five years of related experience; or,
- Equivalent combination of education and experience.
- Minimum of seven years’ experience in Security and GRC
- Strong knowledge and hands-on experience in defining Security and risk approach, role design, authorization concepts and user provisioning
- Collaborate with business and audit teams to manage security effort, design, test and implement security, compliance, and governance solutions
- Experience in implementing and managing core GRC modules in Security applications. Define Risks, conduct risk analysis and monitor for continuous improvements and compliance
- Working with Business, Audit teams to conduct periodic SOX audit reviews and manage remediation effort
- Support business, audit, and IT teams to define mitigation controls and support on-going maintenance
- Integration experience with GRC tools is preferred.
- Retail industry experience and supporting IT controls preferred.
- Familiarity with data privacy or data security policies and regulations preferred
- Working knowledge of industry compliance or frameworks like PCI, NIST, ISO27002, etc.
- Working knowledge of AI governance, machine learning, generative AI, large language models, AI agents, and common AI lifecycle risks is beneficial.
- Experience translating complex technology, AI, security, and regulatory risks into clear business decisions, control requirements, and executive-level reporting.