IT Security Lead - Risk Management

IT Security Lead - Risk Management Location(s): Toledo, OH, US, 43659-0001 Function: Information Technology Audience: Experienced Professional Work Arrangement: On Site Requisition ID: 69153 PURPOSE OF THE JOB The IT Security Lead - Risk Management is a critical member of the Owens Corning Global Information Services (GIS) Security team. This role supports the Governance, Risk, and Compliance (GRC) function by executing cybersecurity governance activities, performing risk assessments, maintaining security policies and standards, supporting audits, and enabling compliance across the enterprise. This role has global responsibility for identifying, analyzing, documenting, and communicating cybersecurity risks and control gaps in support of the cybersecurity risk framework. Strong analytical skills are required to assess complex environments, identify emerging risks and inconsistencies, and translate findings into clear, actionable guidance for risk owners and leadership. The IT Security Lead - Risk Management also supports cybersecurity compliance activities across projects, programs, facilities, and business functions. This role manages information security communications, including policies, standards, and related requirements, ensuring updates are documented, approved, and communicated in alignment with governance expectations. Success in this role requires comfort operating in a fastpaced environment, managing multiple priorities, and adjusting to changing business needs. Curiosity, integrity, honesty, and strong attention to detail are essential, particularly when working with regulatory requirements, audit evidence, risk documentation, and enterprise reporting. Reports to: IT Security Leader - Governance, Risk and Compliance Span of Control: Individual Contributor JOB RESPONSIBILITIES Knowing Our Businesses and their Strategies - Maintain strong awareness of evolving security standards, regulatory requirements, and industry best practices, and assess their impact on organizational risk posture and compliance obligations. - Enable effective governance and audit readiness for Business Continuity and Disaster Recovery (BCP/DR) controls, aligned with information security, incident response, and compliance requirements. - Identify opportunities to align security and compliance initiatives with strategic business programs (e.g., digital transformation, AI adoption, operational resilience), ensuring security is embedded as a business enabler rather than a constraint. - Provide governance support for AI and machinelearning capabilities by maintaining and evolving security, governance, and responsibleAI policies aligned to enterprise objectives; executing AI security and risk assessments to identify control gaps and emerging risks; coordinating with Legal, Privacy, and business stakeholders to ensure alignment with regulatory, ethical, and compliance expectations; and continuously monitoring regulatory developments, industry trends, and emerging risks to inform and strengthen governance practices. Executing Strategy Support enterprise cybersecurity governance and compliance efforts, including development and maintenance of information security policies, standards, procedures, and ISO 27001 ISMS documentation. Perform compliance and assurance activities, including internal control reviews and external audit coordination. Perform information security risk assessments in accordance with the cybersecurity risk framework. Identify control gaps, weaknesses, and emerging risks, document findings clearly and consistently. Support risk owners with analysis, impact statements, and documentation. Track and report risk remediation activities and status. Execute thirdparty security as