Governance, Risk, & Framework Analyst

Job ID: 525936

CRH is a leading global diversified building materials group, employing over 75,800 people at more than 3,160 locations in 29 countries.

CRH is the leading building materials company in North America and the world.

We manufacture and distribute a diverse range of superior building materials, products, and solutions, which are used extensively in construction projects of all sizes.

Job Summary

As part of the Group Information Security team and reporting to the Governance, Risk and Frameworks Manager, the successful candidate will contribute to driving strategy and multi-year program plans aimed at reducing overall cyber risk, while also supporting related Group reporting and governance requirements.

Given the increasing need for global alignment and continuous improvement across CRH, the role will work closely with Group, Divisional, and OpCo teams to ensure adherence to policy and best practices.

The candidate will help drive standardization, tracking, and measurement of information security metrics and management across 150+ CRH entities, covering cyber governance, risk, best practice, and framework activities.

The role will involve extensive engagement across divisions, regions, and OpCo management on key work areas, contributing to programs that will be reported to the Global Information Security (Cyber) Council-chaired by the Group Finance Director and part of the Global Leadership Team (GLT).

The outputs and progress tracking will form key components of the biannual Audit Committee updates and regular GLT updates.

Job Location

This role is based at our corporate office in the Perimeter area of Atlanta, GA - hybrid work schedule

Job Responsibilities



* Develop, implement, and continuously enhance global cyber risk assessment processes covering 150+ CRH entities, ensuring consistent reporting, oversight, and governance across the Group.


* Develop, roll out, and support the adoption of information security standards and best practices across the Group, enabling local IT teams and functions to meet minimum security requirements.


* Design and deploy the Group's third-party due diligence assessment process.


* Collaborate with Group, Divisional, and OpCo teams to identify, assess, mitigate, and monitor supplier related risks.


* Maintain, enhance, and support Group alignment with IEC/ISO 27001 accreditation requirements.


* Provide advisory and consultancy support to OpCos and business units to strengthen their information security controls and practices.


* In alignment with Financial Regulatory Controls (FRC) and Sarbanes Oxley (SOX) reporting requirements, develop and support the execution of key entity level cyber controls, including incident reporting and security awareness.


* Partner closely with Group and Divisional teams-including Legal, Compliance, Finance, Risk, IT, and Internal Audit-to support the planning, execution, and remediation of internal and external audit findings a...