Sr. Security GRC Solutions Architect

Summary

At Greenbrier, we do the hard work that matters. The Greenbrier Companies (NYSE:

GBX) is powering the movement of products around the world as a leading designer, manufacturer and supplier of freight rail transportation equipment and services.

Greenbrier’s heritage of hard work and industrial innovation is celebrated at every level of our organization. We structure our business to support teams that deliver innovative solutions for our customers while positively impacting the world around us.

Greenbrier’s success begins with people. We believe in supporting our global workforce through our unwavering attention to Safety, Quality, Respect for People and Customer Satisfaction. Our Inclusion, Diversity, Engagement, Access and Leadership (IDEAL) commitment is rooted in these values, which lead to a culture where employees are engaged and feel good about coming to work every day.

The Sr. Security GRC Solutions Architect is rooted in IT SOX, SOC-1/2, NIST CSF 2.0, CIS and ISO compliance, the objective is automation. Microsoft E5 licensing is fully deployed, and Sentinel is enabled across the environment. Control evidence is tracked in spreadsheets.

The Sr. Security GRC Solutions Architect will be the 1st line of defense who understands the audit requirements deeply but possesses the technical acumen to leverage Sentinel, KQL, Logic Apps, and Audit Board to automate evidence collection and near real-time monitoring.

They will work directly with the Sr. Manager - GRC and CISO to support the compliance program and IT organization during audits. Working with cross-functional, global teams and communicating with stakeholders at all levels across the company is a regular part of the position. Responsible for supporting IT control requirements and/or IT audit activities, including the development, implementation, and maintenance of processes, procedures, and operational structure.

Requires strong attention to detail and the ability to work within established compliance and control frameworks.

To perform this job successfully an individual must be able to perform the following essential duties satisfactorily. Other duties may be assigned to address business needs and changing business practices.

• Audit Preparations and Auditor Access:
  Bulk upload SOX/SOC audit requests to centralized tool during interim and roll-forward testing periods. Coordinate auditor access to Greenbrier systems, as needed.

• Audit Evidence Request Monitoring:
  Monitor audit evidence request tickets in centralized tool to ensure responses to auditors meet agreed upon milestones. Facilitate evidence request issues and coordinate meetings between IT stakeholders and relevant auditors.

• Compliance Liaison:
  Liaison between control owners and auditors/assessors for the evidence collection process and audit testing follow-ups. Assist Control Owners with evidence requests from auditors. Schedule meetings as needed.

• Control Automations:
  Facilitate and drive progress on control automation efforts, coordinating with subject matter experts, control owners, and automation teams.

• Control Changes:
  Ensure control description and design changes and relevant procedure documentation get updated into the GRC tool master control list in a timely manner.

• Control Failure Triage:
  Work with control owners/performers to perform root cause analyses on control issues and deficiencies, initiate risk-based remediation plans, and follow escalation procedures. May facilitate control remediation execution.

• Control Improvements:
  Support and implement control improvements, automation, and update relevant documentation, at the direction of management

• Control Monitoring:
  Using GRC Tool, monitor SOX/SOC controls for adequate completion by Control Owners and performers and secondary reviewers. Create dashboards for monitoring metrics by global region (U.S. vs. Europe)

• Control Remediations:
  Design and track all assigned remediation plans through to timely completion. Provide status updates of remediation plans to key stakeholders within the organization. Document as needed.

• Escalations:
  Proactively monitor audit follow-ups to identify potential control issues or failures, and missing or unavailable evidence, and follow internal escalation protocols immediately so GRC can triage.

• GRC Consultations:
  Provide audit, control, and evidence guidance to internal security and IT teams;
  Partner with internal and external stakeholders to assist the IT organization during audits.

• Automated Control Monitoring:
  Replace manual spreadsheet tracking by architecting and deploying Sentinel Analytics Rules and KQL queries that monitor controls (e.g., terminated user access, privileged account activity, and unauthorized changes).

• Evidence Orchestration (The "Vault" Strategy):
  Build and maintain Logic App Playbooks to automatically generate "Auditor-Ready" evidence packs upon control triggers, ensuring data is captured and preserved before log retention periods expire.

• Audit Board & Service Now…