IT Compliance & Risk Manager

Description

Headquartered in St. Louis, Missouri with more than 1,200 employees and nearing $2B in revenue, Alberici is a diversified construction company that partners with leading organizations throughout North America to build their most challenging and important projects.

Since our founding in 1918, Alberici earned a reputation for executing with quality, safety and trust. Combined with our 100+ years of experience, we provide construction solutions to the automotive, commercial, civil, energy, food & beverage, healthcare, heavy industrial, industrial process, and water industries.

We build the critical structures that improve lives and strengthen communities.

Our mission is simple — and our approach to delivering on it is equally straightforward. We are as open and honest with our employees and partners as we are with our clients. We are here to work together to do the best work possible to bring this mission to life.

When it comes to our team, Alberici employees are built differently. We seek the best and brightest and are committed to investing in our people and providing the training and resources they need to learn, grow, and advance. Are you Built for the Challenge
?

• Profit-sharing plan, cash bonus programs and annual cost-of-living adjustments
• Generous salary increases and per diems for qualified out-of-town assignments
• Health, dental and vision insurance eligibility on day one
• Paid parental leave
• Continuing education reimbursement
• Personalized career development and training programs
• Minimum of 29 days of PTO (including holidays) for entry-level roles
• Fitness center for St. Louis office-based team members
• Gym membership reimbursement for project-based team members
• Corporate office cafeteria access
• Employee Resource Group (ERG) opportunities
• Philanthropy opportunities

IT Risk Management

• Establish and maintain the enterprise IT risk management framework aligned with industry best practices (e.g., NIST CSF, ISO 27001).
• Identify, assess, and prioritize technology and cyber risks across systems, infrastructure, cloud services, and construction jobsite technologies.
• Conduct risk assessments for new systems, vendors, and technology initiatives.
• Develop and track remediation plans, ensuring timely mitigation of identified risks.
• Prepare regular IT risk reporting for executive leadership and key stakeholders.

• Lead IT compliance efforts related to applicable regulations and standards, such as CMMC, HIPPA, CCPA, GDPR, and client contractual requirements.
• Maintain, and communicate IT policies, standards, and procedures; ensure company wide adoption and alignment.
• Coordinate internal and external IT audits, ensuring evidence collection and timely completion of remediation activities.
• Support compliance related to construction-specific client and project requirements (e.g., data protection clauses, cyber insurance, federal project requirements).
• Maintain documentation of compliance controls, processes, and key artifacts.

• Partner with the cybersecurity team to ensure compliance with security controls, including access management, incident response, vulnerability management, and disaster recovery.
• Monitor status of cybersecurity initiatives and support alignment with risk and compliance frameworks.
• Contribute to business continuity and disaster recovery planning, testing, and documentation.

• Oversee IT vendor risk assessments and ensure relevant security and compliance requirements are included in contracts.
• Maintain a risk register of critical vendors and monitor ongoing risk and compliance posture.

• Implement and support IT compliance and risk awareness initiatives across the organization.
• Conduct training for IT staff and business users on policies, standards, and best practices.

• Serve as an advisor for IT and construction-tech projects, ensuring compliance and risk considerations are incorporated early in project planning.
• Provide guidance on secure and compliant implementation of new technology, jobsite solutions, and data-sharing processes.