Cybersecurity Governance, Risk and Compliance

Vitol, a global energy and commodities company, is seeking a Cybersecurity Governance, Risk and Compliance Officer. The company specializes in the trading and distribution of energy products, handling over seven million barrels of crude oil and products daily, and operates from 40 offices worldwide. Vitol is also invested in renewable energy projects, with over $2.5 billion committed to low-carbon opportunities. The main responsibilities of the role include ensuring compliance with relevant laws, regulations, and standards, and developing, enforcing, and monitoring security policies. The officer will also identify and assess risks across the organization, conduct risk assessments, and implement mitigation strategies. Additionally, the role involves maintaining information asset inventories, performing security audits, and ensuring that Vitol affiliates comply with the company's cybersecurity policies and standards. Travel to affiliate locations is required. To qualify, candidates must have at least three years of professional experience in cybersecurity, with a focus on auditing, governance, and risk management. A strong understanding of regulatory requirements and industry standards, such as NIS2, is essential. Relevant security certifications, such as CRISC or CISA, are required. Familiarity with security control frameworks like CIS Controls, NIST Special Publication 800-53, and cybersecurity frameworks such as NIST CSF and ISO27001, is also necessary. Nice-to-have skills include familiarity with modern security architectures and incident responses. The role is based in a team-oriented environment with a strong emphasis on ethical standards and integrity. The position may require working beyond normal business hours and a user/business focus. What the role asks for: - 3+ years of professional experience in cybersecurity, with focus on auditing, governance, risk management. - Strong understanding of regulatory requirements and industry standards (eg. NIS2) - Relevant security certifications such as CRISC, CISA. - Familiarity with security control frameworks: CIS Controls, NIST Special Publication 800-53 - Familiarity with cybersecurity frameworks: NIST CSF, ISO27001