Information Security Risk Mgmt Anlst

CITGO PETROLEUM CORPORATION

CITGO Petroleum Corporation is a recognized leader in the refining industry and operates under the well-known CITGO brand.

CITGO owns and operates three refineries located in Lake Charles, LA.; Lemont, IL.; and Corpus Christi, TX, and wholly and/or jointly owns 38 active terminals, six pipelines and three lubricants blending and packaging plants.

With approximately 3,300 employees and a combined crude capacity of approximately 807,000 barrels-per-day (bpd), positions CITGO as one of the best-branded supplier companies in the industry.

At CITGO our people are our most important resource.

Our core values are Safety, Integrity, Respect, Accountability, and Care.

Job Summary

The Risk Management Analyst is responsible for identifying, assessing, and managing cybersecurity risks across the organization's IT and OT environments.

The analyst leads CITGO efforts in hardware / software and systems risk assessments, Risk Management, cybersecurity policy and procedure management, and cybersecurity governance.

In this dynamic role, the employee oversees critical areas such as cyber risk assessments, policy and procedure rollout to system owners, and incident response planning, ensuring our business remains resilient and secure.

As a key contributor, the employee collaborates with cross-functional teams to drive compliance initiatives, protect sensitive data, and help maintain the trust of CITGO's information.

Minimum Qualifications

Required:


* Bachelor's degree and 8 years of experience; or associate's degree and 10 years of experience; or high school diploma and 12 years of experience.


* Awareness of emerging technologies and their associated risks.


* Advanced analytical and problem-solving skills for assessing and prioritizing risks.


* Compliance Standards: Familiarity with standards like ISO 27001 and NIST 800.53, 800.144 and 800.82.


* IT and OT Risks: General knowledge of risks that impact IT and OT systems.


* Supply Chain and Third-Party Cyber Risk Management (TPRM): Knowledge of best practices for TPRM, including highest priority risk mitigation practices.


* Attention to Detail: Precision in managing risk assessments and governance to ensure adherence to compliance standards.

Preferred:


* CISSP, CRISC or other security or compliance certifications.

Job Duties

Comprehensive Infrastructure Risk Assessment:

Conduct regular and thorough cybersecurity risk assessments across the organization's entire IT and OT infrastructure, including networks, cloud environments, data centers, endpoints, IoT devices, and software applications.

Ensure risk assessments are aligned with industry frameworks like NIST, and CIS Controls to identify and prioritize risks.

Regularly review security configurations and controls for effectiveness and compliance with organizational policies and external regulations (e.g., GDPR, CCPA, PCI DSS).

Assist in evaluating cybersecurity risks posed by ...