IT Manager at Murphy USA in El Dorado, AR

Job description

GENERAL DESCRIPTION OF POSITION The Manager Governance, Risk Management, and Compliance (GRC) & Security will be part of Murphy USA Cyber risk and compliance team and will work closely with Business, SOX, PCI and Compliance team(s) to implement industry best practices, and establish internal standards in GRC & Security domain. The Manager GRC & Security will be responsible for identifying and mitigating IT control gaps and partnering with business, product & engineering teams on remediation items. This position will partner with business, product, engineering, data, and technology teams to integrate appropriate governance, security, privacy, human oversight, and control requirements throughout the technology and AI lifecycle. ESSENTIAL DUTIES AND RESPONSIBILITIES This individual will work closely with functional, business and audit teams to gather security requirements, design and implement security solutions, in compliance with Security, regulatory, organizational PCI and SOX controls. Manage & work with Murphy USA vendors on on-going security role and authorization changes to meet business and security compliance requirements. Plan, lead and execute the company’s IT SOX program including performing risk assessments, leading walk throughs and overseeing tests of design and operational effectiveness of IT controls Participate in annual and ongoing SOX scoping to identify any changes to the systems, applications, and automated controls considered to be in-scope for the current fiscal year Participate in annual and ongoing PCI certification and identify any changes to the systems, applications, and automated controls considered to be in-scope Monitor management’s remediation efforts to closure, including review of supporting evidence. Evaluate processes for design deficiencies, identify areas of potential improvements and suggest controls to mitigate identified risks. Review new processes from a control’s perspective. Work closely with process owners to design and implement new controls. Assist with annual SOX 404 testing with internal and external auditors, including walkthroughs and test of controls, including IT General Controls, provide support on IT Application Controls, and Key Reports. Lead and manage Murphy USA's Third-Party Risk Management (TPRM) program, conducting assessments with vendors, reporting and working with vendor business, legal and procurement. Conduct security reviews of Master Service Agreements (MSA), Statements of Work (SOW), Non-Disclosure Agreements (NDA), and technology contracts. Oversee risk register for tracking, remediation, and reporting. Manage a team of compliance analysts to accomplish duties and responsibilities as listed Oversee performance and objective setting, reporting, and classification Assist in establishing and maintaining an enterprise AI governance framework including policy, standards, control expectations, approval requirements, and accountability across the AI lifecycle. Lead or coordinate AI use case intake and risk assessments for acquired, embedded, and generative AI solutions. Help coordinate risk-based AI review pathways for low, medium, and high risk use cases and assist business, legal, privacy, security, and AT counsel for executive review as required. Support enterprise data governance initiatives including data classification, data handling standards, retention requirements, and data protection controls. Assist with implementation and monitoring of data governance controls and regulatory requirements. QUALIFICATIONS To perform this job successfully, an individual must be able to perform each essential duty mentioned satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. EDUCATION AND EXPERIENCE BS/BA degree in related discipline and seven years of related experience; or, MS/MA degree in related discipline and five years of related experience; or, Equivalent combination of education and experience. Minimum of