IT Operations Specialist -3rd Party Risk, DLP, PKI

At Fluor, we are proud to design and build projects and careers. We are committed to fostering a welcoming and collaborative work environment that encourages big-picture thinking, brings out the best in our employees, and helps us develop innovative solutions that contribute to building a better world together. If this sounds like a culture you would like to work in, you’re invited to apply for this role.

• Conduct risk assessments for new and existing third-party applications, vendors, integrations, and services, identifying security, privacy, data handling, access, and operational risks.
• Review contracts, Statements of Work, Data Processing Agreements, security exhibits, and vendor responses to identify gaps requiring mitigation, contractual commitments, waivers, or risk-register entries.
• Develop actionable remediation recommendations and coordinate with Legal, Privacy, HR, Compliance, Procurement, business owners, and IT teams to resolve open security concerns.
• Support Microsoft Purview DLP and MIP-related activities, including policy requirements, reusable templates, naming conventions, evidence collection, exception handling, and audit artifacts.
• Review and support PKI/certificate lifecycle concerns, including TLS certificates, signing certificates, certificate ownership, renewal accountability, encryption/key handling, and third-party certificate dependencies.
• Monitor for unauthorized data transfers or inappropriate handling of sensitive information and support response activities when data-protection incidents or exceptions occur.
• Maintain third-party risk review notes, decision records, evidence packages, operating procedures, and repeatable assessment templates.
• Track emerging vendor, data-protection, DLP/MIP, and PKI risks and translate lessons learned into stronger review questions and control expectations.

• Accredited four (4) year degree or global equivalent in applicable field of study and five (5) years of work-related experience or a combination of education and directly related experience equal to nine (9) years if non-degreed; some locations may have additional or different qualifications in order to comply with local requirements
• Ability to communicate effectively with audiences that include but are not limited to management, coworkers, clients, vendors, contractors, and visitors
• Job related technical knowledge necessary to complete the job
• Ability to learn and apply knowledge of applicable local, state/province, and federal/national statutes and guidelines
• Ability to attend to detail and work in a time-conscious and time-effective manner

• Ability to coordinate with stakeholders and respond to time-sensitive vendor, contract, DLP, and certificate lifecycle issues.
• Ability to communicate risk findings clearly to business owners, legal/privacy stakeholders, technical teams, and security leadership.
• Ability to preserve defensible records for governance, audit, and risk management purposes.
• Other duties as assigned.
• Must be able to provide proof of US Citizenship

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Business, Risk Management, or a related field.
• Experience performing third-party risk assessments, application risk reviews, vendor security reviews, or IT security analyst work in an enterprise environment.
• Familiarity with Microsoft Purview DLP, Microsoft Information Protection sensitivity labels, data classification, evidence collection, and data-protection control design.
• Working knowledge of PKI concepts, TLS certificates, certificate authorities, key management, signing/encryption certificates, renewal processes, and ownership practices.
• Ability to review contracts, SOWs, DPAs, security questionnaires, SOC reports, penetration test summaries, and remediation evidence.
• Relevant industry certifications such as CISSP, CISM, CRISC, CISA, Security+, or similar are preferred.
• Strong attention to detail, note-taking, prioritization, and written communication skills, especially when documenting security review outcomes.

We are an equal opportunity employer. All qualified individuals…