Major Responsibilities

ISMS Operations &

- Governance

- Support the operation of the enterprise ISMS foundational layer in alignment with Generac’s Compliance &
- Governance operating model.

- Govern enterprise compliance governance activities across ISO 27001, NIST CSF 2.0, NIST 800-171, TX-RAMP, and other applicable frameworks.

- Leverage authoritative outputs from Risk Management, Privacy, and Incident Response to inform governance decisions and prioritization. Framework, Controls &

- Evidence Management

- Operate and maintain the common Generac Controls Framework (GCF), including control mappings, applicability logic, and evidence expectations.

- Govern the quality, completeness, and traceability of compliance evidence across all enterprise control owners.

- Maintain authoritative enterprise registers for controls, requirements, evidence, exceptions, corrective actions, and assessments.

- Support readiness assessments for emerging regulatory frameworks impacting connected products and digital systems (e.g., EU Cyber Resilience Act), including control mapping and evidence expectations. Assessment &

- Audit Readiness

- Facilitate enterprise compliance assessments, readiness reviews, and surveillance activities.

- Coordinate internal and external audit activities and support auditor engagement and evidence validation.

- Ensure enterprise frameworks and evidence expectations support regulated and contractual obligations while execution remains with designated business-unit compliance teams. Exceptions &

- Corrective Actions

- Govern the enterprise exception and corrective action lifecycle, including intake, approval workflows, tracking, and closure assurance.

- Monitor systemic issues,



exception trends, and remediation effectiveness across the enterprise. Reporting, Communication &

- Enablement

- Produce enterprise compliance KPIs, dashboards, and management-review inputs.

- Provide governance guidance and communications to control owners to clarify expectations and evidence requirements.

- Contribute to enterprise security and compliance maturity assessments and trend reporting (e.g., NIST CSF 2.0), including baseline establishment and re-assessment support. Tooling, Automation &

- Continuous Improvement

- Operate enterprise compliance tooling and workflows.

- Support automation and AI-governance guardrails to improve scale, consistency, and auditability.

Minimum Job Requirements

Education

- Bachelor’s degree (or higher) in Information Security, Cybersecurity, Information Technology, or a related field.

Certification / License

- No certification is required for this role.

- Foundational certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, or other GRC-related credentials are considered an asset. Work Experience

- 4 years of experience in security compliance, GRC operations, ISMS support, or control assurance within an enterprise setting.

- Experience actively supporting, coordinating,



or facilitating compliance assessments or audit readiness activities in a governance or assurance capacity across frameworks such as ISO 27001, SOC 2, NIST-based frameworks, or CMMC.

- Experience working within multi-framework compliance programs, including control mapping, evidence governance, and remediation tracking.

- Experience coordinating compliance activities with distributed control owners and stakeholders across multiple business units or regions. Knowledge / Skills / Abilities

- Strong understanding of security controls, compliance frameworks, and governance practices.

- Familiarity with ISO 27001, NIST CSF, NIST 800-171 / CMMC, TXRAMP, and related regulatory or contractual standards.

- Ability to interpret control requirements and assess the quality, completeness, and traceability of evidence provided by control owners.

- Strong documentation, analysis, and workflow or register management skills supporting auditability and traceability.

- Experience with enterprise compliance tooling, structured registers, or GRC platforms is beneficial.

- Effective communication skills for working with cross-functional stakeholders across business units and regions.

- Ability to manage multiple concurrent compliance activities and deadlines in a distributed enterprise setting.

- High attention to detail with strong organization and follow-through.

- Ability to work independently and collaboratively within a global team.

- Understanding of cloud environments (AWS, Azure, GCP) and their compliance and shared-responsibility considerations.

- Commitment to integrity, accuracy, and maintaining confidentiality of sensitive enterprise information

📌 Security Compliance Analyst (Ramban)
🏢 Generac
📍 Ramban