At Fluor, we are proud to design and build projects and careers. We are committed to fostering a welcoming and collaborative work environment that encourages big-picture thinking, brings out the best in our employees, and helps us develop innovative solutions that contribute to building a better world together. If this sounds like a culture you would like to work in, you’re invited to apply for this role.
The 3rd Party Risk, DLP, and PKI Specialist supports Security Operations by evaluating third-party technology risk, managing data protection control requirements, and supporting certificate and key management governance. The role reviews vendor applications, contracts, Statements of Work, Data Processing Agreements, DLP/MIP requirements, and PKI-related risks to ensure external solutions and internal integrations meet security, privacy, and business requirements.
-
Conduct risk assessments for new and existing third-party applications, vendors, integrations, and services, identifying security, privacy, data handling, access, and operational risks.
-
Review contracts, Statements of Work, Data Processing Agreements, security exhibits, and vendor responses to identify gaps requiring mitigation, contractual commitments, waivers, or risk-register entries.
-
Develop actionable remediation recommendations and coordinate with Legal, Privacy, HR, Compliance, Procurement, business owners, and IT teams to resolve open security concerns.
-
Support Microsoft Purview DLP and MIP-related activities, including policy requirements, reusable templates, naming conventions, evidence collection, exception handling, and audit artifacts.
-
Review and support PKI/certificate lifecycle concerns, including TLS certificates, signing certificates, certificate ownership, renewal accountability, encryption/key handling, and third-party certificate dependencies.
-
Monitor for unauthorized data transfers or inappropriate handling of sensitive information and support response activities when data-protection incidents or exceptions occur.
-
Maintain third-party risk review notes, decision records, evidence packages, operating procedures, and repeatable assessment templates.
-
Track emerging vendor, data-protection, DLP/MIP, and PKI risks and translate lessons learned into stronger review questions and control expectations.
- Accredited four (4) year degree or global equivalent in applicable field of study and five (5) years of work-related experience or a combination of education and directly related experience equal to nine (9) years if non-degreed; some locations may have additional or different qualifications in order to comply with local requirements
- Ability to communicate effectively with audiences that include but are not limited to management, coworkers, clients, vendors, contractors, and visitors
- Job related technical knowledge necessary to complete the job
- Ability to learn and apply knowledge of applicable local, state/province, and federal/national statutes and guidelines
- Ability to attend to detail and work in a time-conscious and time-effective manner
- Ability to coordinate with stakeholders and respond to time-sensitive vendor, contract, DLP, and certificate lifecycle issues.
-
Ability to communicate risk findings clearly to business owners, legal/privacy stakeholders, technical teams, and security leadership.
-
Ability to preserve defensible records for governance, audit, and risk management purposes.
-
Other duties as assigned.
-
Must be able to provide proof of US Citizenship
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Business, Risk Management, or a related field.
-
Experience performing third-party risk assessments, application risk reviews, vendor security reviews, or IT security analyst work in an enterprise environment.
-
Familiarity with Microsoft Purview DLP, Microsoft Information Protection sensitivity labels, data classification, evidence collection, and data-protection control design.
-
Working knowledge of PKI concepts, TLS certificates, certificate authorities, key management, signing/encryption certificates, renewal processes, and ownership practices.
-
Ability to review contracts, SOWs, DPAs, security questionnaires, SOC reports, penetration test summaries, and remediation evidence.
-
Relevant industry certifications such as CISSP, CISM, CRISC, CISA, Security+, or similar are preferred.
-
Strong attention to detail, note-taking, prioritization, and written communication skills, especially when documenting security review outcomes.
We are an equal opportunity employer. All qualified individuals will receive consideration for employment without regard to race, color, age, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, genetic information, or any other criteria protected by governing law.
Benefits Statement: Fluor is proud to offer a comprehensive benefits package designed to promote employee health, wellness, and financial security. Our offerings include medical, dental and vision plans, EAP, disability coverage, life insurance, AD&D, voluntary benefit plans, 401(k) with a company match, paid time off (personal, bereavement, sick, holidays) for salaried employees, paid sick leave per state requirement for craft employees, parental leave, and training and development courses.
Market Rate Statement: The market rate for the role is typically at the mid-point of the salary range; however, variations in final salary are determined by additional factors such as the candidate’s qualifications, relevant years of experience, geographic location, internal pay equity, and prevailing market conditions for the specific role.
Notice to Candidates: Background checks are carried out as part of any conditional offer made, including (but not limited to & role dependent) education, professional registration, employment, references, passport verifications and Global Watchlist screening.
To be Considered Candidates: Must be authorized to work in the country where the position is located.
Salary Range: $83,000.00 - $154,000.00
