The Greenbrier Companies

Solutions Engineer

• Audit Preparations and Auditor Access: Bulk upload SOX/SOC audit requests to centralized tool during interim and roll-forward testing periods.
• Coordinate auditor access to Greenbrier systems, as needed.
• Audit Evidence Request Monitoring: Monitor audit evidence request tickets in centralized tool to ensure responses to auditors meet agreed upon milestones.
• Facilitate evidence request issues and coordinate meetings between IT stakeholders and relevant auditors.
• Compliance Liaison: Liaison between control owners and auditors/assessors for the evidence collection process and audit testing follow-ups.
• Assist Control Owners with evidence requests from auditors. Schedule meetings as needed.
• Control Automations: Facilitate and drive progress on control automation efforts, coordinating with subject matter experts, control owners, and automation teams.
• Control Changes: Ensure control description and design changes and relevant procedure documentation get updated into the GRC tool master control list in a timely manner.
• Control Failure Triage: Work with control owners/performers to perform root cause analyses on control issues and deficiencies, initiate risk-based remediation plans, and follow escalation procedures. May facilitate control remediation execution.
• Control Improvements: Support and implement control improvements, automation, and update relevant documentation, at the direction of management.
• Control Monitoring: Using GRC Tool, monitor SOX/SOC controls for adequate completion by Control Owners and performers and secondary reviewers.
• Create dashboards for monitoring metrics by global region (U.S. vs. Europe).
• Control Remediations: Design and track all assigned remediation plans through to timely completion. Provide status updates of remediation plans to key stakeholders within the organization. Document as needed.
• Escalations: Proactively monitor audit follow-ups to identify potential control issues or failures, and missing or unavailable evidence, and follow internal escalation protocols immediately so GRC can triage.
• GRC Consultations: Provide audit, control, and evidence guidance to internal security and IT teams; Partner with internal and external stakeholders to assist the IT organization during audits.
• Automated Control Monitoring: Replace manual spreadsheet tracking by architecting and deploying Sentinel Analytics Rules and KQL queries that monitor controls (e.g., terminated user access, privileged account activity, and unauthorized changes).
• Evidence Orchestration (The "Vault" Strategy): Build and maintain Logic App Playbooks to automatically generate "Auditor-Ready" evidence packs upon control triggers, ensuring data is captured and preserved before log retention periods expire.
• AuditBoard & ServiceNow Integration: Optimize the integration between our GRC tool (AuditBoard) and our ITSM (ServiceNow) to automate task routing, remediation tracking, and evidence uploads.
• Root Cause Automation: Develop "SLA Breach" logic to detect process lags (e.g., HR termination vs. actual AD disablement) to provide GRC with immediate visibility into control failures before auditors find them.
• Continuous Compliance Liaison: Act as the technical bridge between IT Stakeholders and Auditors. Instead of manual follow-ups, you will build AuditBoard dashboards that provide stakeholders with real-time status of their compliance posture.
• Control Triage & Remediation: Work with control owners to perform root cause analysis on failures. If a control fails, you don't just document it; you help architect the technical fix or automation to prevent recurrence.
• Third-Party Risk (UpGuard): Leverage UpGuard to streamline the assessment of 3rd-party SOC reports and security postures, integrating these findings into our centralized risk register.
• Procedure Modernization: Update and maintain SOX/SOC Control Procedures to reflect automated workflows, ensuring that how we work matches how we are audited.

Senior Security GRC Solutions Architect