Position Summary

TPI Composites is seeking a Senior IT Analyst to establish and mature the Governance, Risk, and Compliance (GRC) function within our global Cybersecurity organization. Reporting directly to the Chief Information Security Officer, this role is the connective tissue between how TPI describes its management of technology risk and how the company actually operates day to day.

The Senior IT Analyst owns TPI's cybersecurity and IT policy portfolio, leads our response to customer and third-party security requirements, drives governance and control assurance across the IT organization, and coordinates the operational reporting that gives leadership a clear and honest view of cyber performance. Working in close partnership with the CISO, this role also builds the practices that allow TPI to identify, quantify, and manage IT and cyber risk together with Finance, Legal, Operations, Human Resources, Supply Chain, and Commercial teams.

This is a high-influence individual contributor position. Success depends less on formal authority than on credibility, clear thinking, and the ability to move a control from a paragraph in a policy to a practice that engineers and plant staff actually follow. It is an ideal opportunity for a GRC professional who wants to shape a program from the ground up in a company where cybersecurity has executive visibility and manufacturing operations make the work tangible.

TPI's control environment is anchored on the NIST Cybersecurity Framework (CSF) 2.0, supported by the CIS Critical Security Controls, and shaped in practice by the security requirements our OEM customers place on us as a strategic supplier.

Key Responsibilities

Policy and Standards Management

- Own the full lifecycle of TPI's cybersecurity and IT policy portfolio.
- Translate policies into supporting standards, procedures, and control statements that are specific enough to be auditable and practical enough to be followed at a manufacturing site.
- Maintain a policy exception and risk-acceptance register, ensuring every exception has a named owner, documented compensating controls, and an expiration date.
- Partner with Legal, Human Resources, and Internal Audit to align cybersecurity policy with the broader corporate policy framework, employee handbook, and disciplinary process.

Customer and Third-Party Compliance

- Serve as the primary owner of customer security requirements — reviewing security schedules and exhibits in commercial agreements, completing customer security questionnaires and assessments, and coordinating evidence collection across IT and Cybersecurity teams.
- Maintain a central repository of customer security obligations, mapping each contractual commitment to the TPI control that satisfies it and flagging gaps to the CISO for remediation planning.




- Support Commercial and Legal teams during contract negotiation and renewal by assessing the feasibility and cost of proposed security terms before TPI commits to them.
- Build and run the third-party and vendor security risk assessment process.
- Coordinate responses to customer audits, on-site assessments, and cyber insurance underwriting questionnaires, and manage remediation commitments through completion.

Cybersecurity Governance Across IT

- Establish and run a control assurance program: define the control set based on NIST CSF 2.0 and the CIS Controls, assign control owners across the Cybersecurity, Infrastructure, Cloud, Applications, and Identity teams, and test control operating effectiveness on a defined cadence.
- Provide governance oversight of security-relevant processes — change management, access provisioning and recertification, backup and recovery, asset inventory, patching, and system hardening — verifying that agreed standards are being met.
- Facilitate a recurring cybersecurity governance forum with IT leadership, tracking open control gaps, remediation commitments, exceptions, and emerging risk items to closure.
- Review proposed technology projects, architectures, and vendor selections for alignment with TPI security standards, documenting security requirements early enough to influence design rather than audit it afterward.
- Maintain the cybersecurity capability model and control library as living documents, using them to show leadership where TPI is strong, where it is thin, and what the next investment should buy.
- Govern TPI’s compliance with data protection and privacy obligations affecting employee and business data, coordinating with Legal and Human Resources on data handling standards, retention, and the technical controls that support them.

Operational Reporting and Metrics

- Own the design, production, and continuous improvement of cybersecurity reporting — monthly and quarterly operational dashboards, executive summaries, and ownership-level material prepared with the CISO.
- Define and maintain the cyber metrics and KPI/KRI set spanning the operational domains.
- Automate data collection and reporting wherever practical.
- Track remediation and program milestones across the Cybersecurity team.
- Prepare reporting and evidence packages for cyber insurance renewal, ownership and lender reporting, customer requests, and executive briefings.

IT and Cyber Risk Management





- Partner with the CISO to build and operate TPI's IT and cyber risk management practice: risk identification, analysis, treatment planning, ownership assignment, and ongoing monitoring.
- Maintain the IT and cyber risk register, ensuring risks are described in business terms — operational disruption, customer commitment failure, data loss, financial exposure — rather than purely technical language.
- Facilitate risk assessment sessions with business functions including Manufacturing Operations, Finance, Supply Chain, Engineering, Legal, and Human Resources to surface risks the IT organization cannot see on its own.
- Support business continuity and disaster recovery governance, including business impact analysis, plan currency, and coordination of recovery exercises with system owners.
- Contribute to incident response readiness by maintaining the governance side of the program: plan documentation, tabletop exercise coordination, post-incident lessons-learned tracking, and contractual or regulatory breach-notification requirements.

Qualifications

Required

- Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Business, or a related field; equivalent professional experience will be considered.
- Five or more years of experience in information security, IT audit, IT risk management, or a related governance discipline, including at least two years with GRC responsibility.
- Demonstrated experience authoring and managing cybersecurity or IT policies, standards, and procedures.
- Working knowledge of cybersecurity control frameworks and the ability to map controls across frameworks and customer requirements.
- Experience completing or coordinating security questionnaires, customer assessments, third-party risk reviews, or audit evidence requests.
- Practical understanding of core security domains.
- Strong written communication skills.
- Professional working proficiency in English and Spanish, written and spoken.
- Highly organized and self-directed, with the ability to manage multiple concurrent commitments in a remote work environment across several time zones.

Preferred

- Professional certification such as CISA, CRISC, CISM, or a NIST CSF practitioner credential.
- Experience in manufacturing, industrial, energy, or another asset-intensive sector, including familiarity with the operational realities of plant environments and OT/IT convergence.
- Exposure to data protection and privacy requirements relevant to a general workforce, including Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), GDPR, and U.S. state privacy laws.
- Prior experience establishing a GRC function where one did not previously exist.

Job Type: Full-time Pay: From $35,000.00 per month

Work Location: In person

📌 IT Security Senior Analyst (Ciudad Juárez)
🏢 Tpi Composites
📍 Ciudad Juárez