Governance, Risk and Compliance Analyst

Global Information Security Grc Analyst – Third-Party Risk

Crown Cork & Seal Usa, Inc., a wholly owned company of Crown Holdings, Inc. is a global leader in the design, manufacture and sale of packaging products for consumer goods. At Crown, we are passionate about helping our customers build their brands and connect with consumers around the world. We do this by delivering innovative packaging that offers significant value for brand owners, retailers, and consumers alike. With operations in 39 countries employing over 23,000 people and net sales of nearly $12 billion, we are uniquely positioned to bring best practices in quality and manufacturing to our customers to drive their businesses locally and globally. Sustaining a leadership position requires us to build a team of highly talented, dedicated, and driven individuals.

The mission of the Global Information Security team is to protect Crown's global information systems, data and employees from cyber-based security threats while ensuring the confidentiality, integrity and availability of information used by the Crown business units to produce world class sustainable packaging solutions to our customers.

You will join a cohesive and collaborative team who love what they do and are committed to creating a safe and secure environment for the Crown family. We are nimble with dynamic backgrounds that foster an environment of continuous learning and growth.

We are seeking a Global Information Security Grc Analyst – Third Party Risk to support the execution and continuous improvement of Crown's cybersecurity governance program. This role is part of Crown's Global Cybersecurity team and will help expand and mature the company's global Grc capabilities, with primary responsibility for supporting third-party security risk management. The role will also support related cyber risk and governance activities, including cybersecurity risk assessments, risk register maintenance, remediation tracking, risk reporting, AI governance, policy governance, compliance, and audit readiness.

The ideal candidate is analytical, collaborative, and passionate about helping the organization manage risk while enabling business objectives.

Key Responsibilities

• Manage the end-to-end third-party security risk assessment process.
• Assess vendor security controls and assurance documentation using ISO 27001, NIST frameworks, and SOC 2 reports.
• Review vendor security documentation, identify risks, and track remediation activities.
• Maintain third-party risk registers and support ongoing vendor monitoring and reporting.

Governance, Risk & Compliance

• Conduct cybersecurity risk assessments and maintain risk registers.
• Support AI governance activities, including risk assessments and inventory management.
• Coordinate cybersecurity policy development, review, approval, and lifecycle activities.
• Support compliance and audit readiness through control testing, evidence collection, and remediation tracking.
• Develop cybersecurity metrics, dashboards, and leadership reporting.
• Identify opportunities to improve and automate Grc processes.

Location

This is a full-time, on-site position based in Yardley, Pennsylvania. Employees are expected to work from the office five days per week, with flexibility in daily start and end times.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, or a related field or equivalent professional experience.
• 3–5 years of experience in cybersecurity, Grc, cyber risk, or third-party risk management.
• Experience conducting security assessments and reviewing vendor security documentation.
• Knowledge of cybersecurity frameworks such as ISO 27001, NIST CSF, and SOC 2.
• Strong analytical, communication, and stakeholder management skills.

Preferred Qualifications

• Certifications such as CISSP, CISM, CISA, CRISC, Security+, or ISO 27001 Lead Implementer/Auditor.
• Experience with Grc platforms such as LogicGate, ServiceNow Grc, Archer, OneTrust, or AuditBoard.
• Familiarity with AI governance frameworks including NIST AI RMF and ISO/IEC 42001.
• Experience supporting cloud security and regulatory compliance initiatives.
• Experience supporting Grc and Tprm activities across multiple countries and cultures.

This role requires collaboration, teamwork, and regular interaction with business stakeholders, technology teams, and external partners.

Join us and become part of a team helping to protect Crown's business through effective cybersecurity governance, risk management, and compliance.

Join us and become part of a team of professionals who are passionate about sustainable packaging!