Compliance and Risk Manager

Role Overview

The Compliance and Risk Manager is a senior practitioner responsible for designing, implementing, and continuously improving Hexion's information security compliance and enterprise risk management programs. This role requires deep expertise across ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, CIS Controls (Levels 1 and
2), and NIST 800-53.

The Compliance and Risk Manager will own Hexion's compliance and risk management programs, ensuring that controls are real, risks are measured, and the organization is audit‑ready every day of the year. This includes managing ISO 27001 certification, SOC 2 compliance, CIS Controls implementation, and NIST 800‑53 enterprise risk governance.

The ideal candidate has spent years in the field — conducting audits, writing controls, managing risk registers, and preparing organizations for certification. They bring the authority of deep experience, the discipline of a compliance professional, and the judgment of a senior risk advisor.

• Bachelor's degree in Information Security, Computer Science, Business Administration, or related field (Master's preferred)
• 7+ years of progressive experience in information security compliance, GRC, or risk management roles
• Demonstrated, hands‑on experience managing ISO 27001 certification programs
• Deep knowledge of ISO 27017 and ISO 27018 cloud security and privacy controls
• Practical SOC 2 Type II experience
• Proficiency with CIS Controls (IG1 and IG2)
• Working knowledge of NIST 800‑53 control families and the NIST Risk Management Framework
• Experience operating enterprise risk management programs

• Competitive salary
• Equity
• Healthcare
• Paid Time Off (PTO)
• Retirement
• Learning budget
• Parental leave
• Wellness
• Visa/relocation assistance
• Remote flexibility
• Stipends
• Bonus/commission
• Paid holidays