Sr. Cybersecurity Governance and Compliance… at Legrand · Reno

Join Legrand in Reno, NV, as a Senior Cybersecurity Governance and Compliance Specialist and help strengthen cybersecurity practices across multiple businesses. You’ll turn evolving standards, regulations, audits, and customer needs into practical action while advancing ISO 27001 and product cybersecurity readiness. Partner across Cybersecurity, Engineering, IT, Product Management, and business teams to build repeatable processes, coordinate assessments, close gaps, and drive compliance initiatives from planning through completion.

Legrand has an exciting opportunity for a Senior Cybersecurity Governance and Compliance Specialist to join the Power & Thermal Management division in Reno, NV.

The Senior Cybersecurity Governance and Compliance Specialist will establish and manage practical cybersecurity governance and compliance activities across multiple businesses. This role will help the businesses respond consistently and efficiently to ISO 27001 requirements, cybersecurity regulations, customer requests, external audits, product cybersecurity needs, vulnerability-management obligations, and related customer communications.

The Senior Specialist will translate requirements into clear business actions, develop and maintain compliance documentation, bring the right teams together, establish owners and timelines, identify gaps early, and keep projects moving through closure. The role will serve as a key interface with the corporate cybersecurity team and will coordinate technical cybersecurity activities when specialized engineering, security, testing, or third-party resources are required.

This is a hands-on senior individual-contributor role. The Senior Specialist is expected to perform the governance and compliance work that can reasonably be centralized, including developing documentation, maintaining evidence, coordinating assessments, preparing responses, managing action plans, managing qualified outside service providers, and establishing repeatable processes. Technical teams and Corporate Cybersecurity will provide or approve specialized technical work and technical inputs as appropriate.

Success in this role requires someone who is solution-oriented, organized, technically fluent, comfortable working across multiple teams and businesses, and able to translate technical and regulatory requirements into practical business actions. The expectation is to understand business needs, engage the appropriate subject-matter experts, develop workable options, recommend a path forward, and drive follow-through.

The role leads through expertise, process ownership, coordination, project management, and influence rather than direct personnel management. Technical cybersecurity decisions, product design decisions, legal and privacy interpretations, contractual commitments, notification approvals, and significant risk decisions remain with the appropriate functional and business leaders.

Responsibilities

Main Job Duties: • Establish and manage cybersecurity governance and compliance processes across participating businesses. Use common processes, templates, tools, and documentation wherever practical while keeping ownership for technical decisions, resources, risks, and business commitments clear. • Translate cybersecurity regulations, standards, contractual obligations, and customer requirements, including the EU Cyber Resilience Act and applicable requirements of the IEC 62443 series, into manageable business actions. Coordinate applicability and scope assessments with the appropriate technical, legal, compliance, product, Corporate Cybersecurity, and business experts. • Develop, maintain, and control cybersecurity compliance documentation and supporting evidence. Obtain technical input from subject-matter experts and incorporate it into accurate, usable, and reusable compliance and customer deliverables. • Coordinate product cybersecurity regulatory readiness, including required documentation, evidence, vulnerability-handling processes, conformity activities, lifecycle obligations, and other applicable requirements. Establish owners and timelines and keep actions moving through closure. • Facilitate the ISO 27001 Information Security Management System (ISMS), including policies, risk and treatment-plan coordination, Statement of Applicability, objectives, management reviews, audits, corrective actions, evidence collection, and continual improvement. Responsibility for implementing and operating individual controls remains with the appropriate control owners. • Manage a consistent intake and response process for customer cybersecurity questionnaires, assessments, contractual requirements, certification inquiries, regulatory questions, audit requests, and internal cybersecurity needs. Develop reusable responses and supporting evidence where practical. • Coordinate with Corporate Cybersecurity and Engineering to apply established cybersecurity architecture requirements to applicable products, systems, and business activities. Identify applicability and gaps, establish owners and timelines, and coordinate exceptions or unresolved issues through the appropriate review and approval process. • Coordinate vulnerability scanning, penetration testing, secure-code or source-code analysis, and other cybersecurity assessment activities when required. Work with Corporate Cybersecurity and appropriate technical teams to establish scope and objectives; manage qualified external laboratories, consultants, or service providers when needed; coordinate schedules, access, deliverables, findings, retesting, and retained evidence; and track resulting actions through closure. • Maintain governance and oversight of product vulnerability-management activities. Coordinate monitoring, technical applicability reviews, disposition records, remediation commitments, disclosures, supporting evidence, and follow-up. Specialized technical analysis and remediation are performed or approved by the appropriate Engineering, IT, Corporate Cybersecurity, or other qualified technical resources. • Coordinate remediation of cybersecurity findings with Corporate Cybersecurity, Engineering, IT, Product Management, and other applicable owners. Establish priorities, owners, and timelines; maintain status and supporting evidence; coordinate validation or retesting; and escalate issues that cannot be resolved within required business, customer, or regulatory timelines. • Coordinate applicable cybersecurity monitoring and intelligence activities with Corporate Cybersecurity and maintain appropriate supplemental third-party vulnerability, threat, regulatory, or product-security monitoring services where needed. Establish a process to evaluate relevant alerts, route them to the appropriate technical owners, document disposition, and track required actions through closure. • Coordinate business response to applicable cybersecurity incidents through Corporate Cybersecurity and the appropriate business and technical teams. Support stakeholder coordination, product and business impact assessment, documentation, customer or regulatory communication requirements, corrective actions, lessons learned, and follow-through. Specialized technical investigation, containment, forensics, eradication, and related response activities remain with qualified technical resources. • Coordinate product cybersecurity advisories, disclosures, and customer notifications. Establish a repeatable process for affected-product identification, technical input, approvals, publication, customer communication, and retained records. • Support external certification, customer, regulatory, and third-party audits and assessments. Coordinate scope, schedules, stakeholder preparation, evidence, auditor questions, findings, corrective actions, and verified closure. Work with control owners to address gaps early. • Establish clear owners, dates, expectations, approval paths, and escalation points for cybersecurity compliance activities. Maintain practical action plans and escalate unresolved gaps with business impact, realistic options, and a recommended path forward. • Establish and facilitate cross-functional working groups when needed. Define purpose, membership, cadence, decision rights, expected outputs, and escalation paths so meetings drive decisions and closure rather than simply provide status. • Maintain auditable and appropriately version-controlled records and provide practical dashboards and leadership updates that clearly communicate status, business impact, risk, decisions needed, recommended next steps, and overdue dependencies. • Identify opportunities to solve common needs once across multiple businesses through common processes, templates, repositories, structured data, training, supplier coordination, automation, and lessons learned. • Perform other duties as assigned.

Qualifications

Education: • Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, Risk Management, Regulatory Affairs, Business, or a related field, or an equivalent combination of education and relevant experience.

Experience: • A minimum of 5 years of relevant experience in cybersecurity governance, information security compliance, product cybersecurity compliance, ISO 27001 / ISMS, audit and assurance, regulatory compliance, cybersecurity project management, or technical program coordination is preferred.
• Experience should demonstrate the ability to independently lead complex cross-functional work, develop compliance documentation, work effectively with Engineering and cybersecurity subject-matter experts, manage external technical engagements, exercise sound judgment, and drive work through closure without direct reporting authority.

Preferred Qualifications: • Experience supporting an ISO 27001 implementation, certification audit, surveillance audit, or established ISMS. • Working knowledge of the EU Cyber Resilience Act and product cybersecurity lifecycle requirements. • Familiarity with cybersecurity frameworks and practices such as the NIST Cybersecurity Framework, IEC 62443, UL 2900, secure-development lifecycle practices, vulnerability management, coordinated vulnerability disclosure, incident response, and third-party risk management. • Experience supporting cybersecurity requirements for connected electrical, electronic, firmware-enabled, or software products. • Experience responding to complex customer cybersecurity questionnaires, contractual requirements, audits, assessments, or certification inquiries. • Experience planning or coordinating penetration testing, vulnerability scanning, source-code or secure code review, cybersecurity assessments, or other specialized security engagements using internal or external technical resources. • Experience managing external cybersecurity laboratories, consultants, testing firms, or other technical service providers, including scope, schedule, deliverables, findings, and follow-up. • Familiarity with CVEs, CVSS, CWEs, CPEs, Software BOMs, vulnerability-intelligence sources, component or dependency matching, applicability assessment, and vulnerability disclosure. • Experience coordinating corrective actions, technical remediation, product-security issues, cybersecurity incidents, customer notifications, or cross-functional cybersecurity programs. • ISO 27001 Lead Implementer or Lead Auditor, Security+, CISA, CRISC, CISSP, or comparable training or certification. • Experience supporting multiple businesses, sites, product families, or legal entities in a shared-services environment. • Experience improving workflows through standardized documentation, dashboards, structured data, automation, and AI-enabled tools.

About the Company

Legrand is the global specialist in electrical and digital building infrastructures. Its comprehensive offering of solutions for residential, commercial, and datacenter markets makes it a benchmark for customers worldwide.

Trusted by the world’s largest hyperscalers, Legrand's Power & Thermal Management division helps operators manage the critical infrastructure that powers modern data centers. Through a portfolio of best-in-class brands spanning power, cooling, connectivity, management, and supporting infrastructure, we enable customers to deploy, operate, and scale high-density environments. Combining deep domain expertise with a customizable design approach and dedicated support services, we help customers build and operate resilient infrastructure that meets current performance requirements while adapting to future demands. Power & Thermal Management industry-leading brands include Approved Networks, Raritan, Server Technology, Starline, Ortronics, Kratos Industries, and ZPE Systems.

Legrand, North & Central America offers comprehensive medical, dental, and vision coverage, as well as distinctive benefits like a high employer 401K match, paid time off (PTO) and holiday pay, short-term and long-term disability benefit plans, above-benchmark paid maternity and parental leave, bonus opportunities in accordance with the Company’s incentive plans, paid time off to volunteer, and an active/growing Employee Resource Group network. For more information, visit legrand.us.