Cybersecurity Governance, Risk and Compliance

Vitol, a global energy and commodities trader with $331 billion in 2024 revenue, is looking for a Cybersecurity Governance, Risk and Compliance professional. The role sits within Vitol's security function and supports the company's worldwide network of offices, ships and affiliates, ensuring that the firm's cyber posture aligns with its extensive trading and renewable‑energy activities. The day‑to‑day work revolves around five core areas. First, the officer will develop, enforce and continuously review security policies, standards and procedures to meet applicable laws and regulations. Second, they will assist in identifying, assessing and reporting on security risks, proposing mitigation actions where needed. Third, they will keep an up‑to‑date inventory of information assets, categorising critical items and mapping the controls that protect them, while owning the cybersecurity Control Catalog. Fourth, they will conduct internal security audits, respond to external audit requests and manage third‑party assessments, maintaining a vetted supplier and tool register. Finally, the role focuses on Vitol's affiliate companies, requiring periodic travel to ensure those entities stay compliant with Vitol's cyber policies. To succeed, candidates must bring at least three years of professional experience in cybersecurity, specifically in auditing, governance and risk management. A solid grasp of regulatory obligations and industry standards such as NIS2 is essential, as is familiarity with modern security architecture best practices and incident‑response techniques. The employer expects holders of recognised security certifications, particularly CRISC or CISA, and knowledge of control frameworks like CIS Controls and NIST SP 800‑53, together with experience with broader cybersecurity frameworks such as NIST CSF and ISO 27001. The position offers exposure to a high‑impact, globally distributed environment and involves regular interaction with Vitol's affiliate network. Travel to affiliate sites is part of the job, providing insight into diverse operational contexts. The team values energetic, analytical individuals who can work both independently and collaboratively, meet tight deadlines, and communicate clearly across the organisation. While the role may extend beyond standard business hours, it promises a chance to shape security culture across a leading energy trader. What the role asks for: - 3+ years cybersecurity experience in auditing, governance, risk - Strong understanding of regulatory requirements (e.g., NIS2) - Knowledge of modern security architecture and incident response - CRISC or CISA certification - Familiarity with CIS Controls and NIST SP 800‑53 - Familiarity with NIST CSF and ISO 27001 - Willingness to travel to affiliate locations - Ability to work beyond normal business hours (nice‑to‑have)