Director, IT Governance, Risk & Compliance

There’s more to CMC than our products and the buildings, structures, and roads they go into. At CMC, it’s the people inside our recycling centers, fabrication plants, manufacturing facilities, steel mills and offices that make us who we are as a company. Our success comes from finding, retaining, and supporting the highest quality talent by offering:

• Day 1 Benefits Coverage with low cost Medical, Vision, Dental
• Day 1 Paid-time Off and Vacation
• 4.5% Company Match 401(k) plan
• Competitive Compensation and Bonuses
• Company-paid Life and Disability Insurance
• Employee Stock Purchase Plan
• Training and Advancement Opportunities

it’s what’s inside that counts

CMC provides an excellent opportunity to learn the steel, construction reinforcement and ground stabilization industries and to grow in your career. Whether you will spend your day brainstorming in an office cubicle, operating a crane, running manufacturing equipment or troubleshooting technical obstacles, at CMC, you’ll get the training and support from your team that you need to excel in your role and reach your full potential.

• Lead the continued maturation of CMC's IT Governance, Risk & Compliance program and define the next phase of its maturity strategy
• Establish consistent governance standards, accountability models, decision rights, and control ownership across technology functions
• Strengthen control design, policy management, compliance monitoring, and standard artifacts, with rigor proportionate to financial, regulatory, cybersecurity, and operational risk
• Drive alignment among business objectives, technology strategy, compliance requirements, and risk management priorities
• Promote a culture of accountability, operational discipline, and continuous improvement in which compliance is embedded in day-to-day delivery
• Serve as the primary IT leadership interface for Internal Audit, external auditors, and compliance stakeholders
• Improve audit readiness through standardized evidence management, documentation practices, remediation governance, control monitoring, request intake, and clear closure criteria
• Partner with technology and business leaders to proactively address audit findings, improve evidence quality, and reduce recurring deficiencies and late-cycle surprises
• Provide executive-level insight on governance maturity, compliance performance, control effectiveness, remediation aging, evidence quality, and emerging risk
• Ensure compliance activities improve operations and control effectiveness rather than simply satisfy audit requirements, while maintaining the distinction between management ownership and independent assurance
• Oversee ITGC and SOX compliance across access management, change management, computer operations, interfaces, key reports, and technology-dependent controls
• Establish and execute annual approach to IT SOX scoping in collaboration with Internal Audit and management stakeholders
• Direct governance for SAP access, segregation of duties, privileged access, Firefighter / emergency access, user access reviews, and SAP GRC capabilities
• Establish a risk-based method to prioritize deficiencies by financial reporting exposure, regulatory impact, cybersecurity risk, and operational complexity
• Partner with IT, Finance, Internal Audit, Cybersecurity, and business stakeholders to support effective governance, compliance, and control execution
• Support business units and control owners in identifying IT control gaps
• Provide training and guidance to IT control owners and business unit managers on SOX requirements, control objectives, and best practices
• Implement a repeatable evidence operating model with standardized repositories, request ownership, naming conventions, quality checks, retention requirements, and closure…