Governance, Risk and Compliance Analyst

Crown Holdings, Inc. through it's subsidiaries, is a world leader in the metal packaging production process. We design and manufacture a wide range of innovative and sustainable metal packaging solutions and products. Our clients are some of the largest and most respected companies in the world.

Crown is dedicated to building a team of highly talented, dedicated, and driven individuals. It's an exciting time to join our business because Crown offers you the opportunity to grow and develop your skills in an expanding industry.

Crown was founded with the goal of valuing and promoting sustainability and this vision continues to be essential to our long-term future.

Job Description:

Global Information Security GRC Analyst – Third-Party Risk

The Company:

CROWN Cork & Seal USA, Inc., a wholly owned company of Crown Holdings, Inc. is a global leader in the design, manufacture and sale of packaging products for consumer goods. At Crown, we are passionate about helping our customers build their brands and connect with consumers around the world. We do this by delivering innovative packaging that offers significant value for brand owners, retailers, and consumers alike. With operations in 39 countries employing over 23,000 people and net sales of nearly $12 billion, we are uniquely positioned to bring best practices in quality and manufacturing to our customers to drive their businesses locally and globally. Sustaining a leadership position requires us to build a team of highly talented, dedicated, and driven individuals.

The Team:

The mission of the Global Information Security team is to protect Crown’s global information systems, data and employees from cyber-based security threats while ensuring the confidentiality, integrity and availability of information used by the Crown business units to produce world class sustainable packaging solutions to our customers.

You will join a cohesive and collaborative team who love what they do and are committed to creating a safe and secure environment for the Crown family. We are nimble with dynamic backgrounds that foster an environment of continuous learning and growth.

The Job:

We are seeking a Global Information Security GRC Analyst – Third Party Risk to support the execution and continuous improvement of Crown’s cybersecurity governance program. This role is part of Crown’s Global Cybersecurity team and will help expand and mature the company’s global GRC capabilities, with primary responsibility for supporting third-party security risk management. The role will also support related cyber risk and governance activities, including cybersecurity risk assessments, risk register maintenance, remediation tracking, risk reporting, AI governance, policy governance, compliance, and audit readiness.

The ideal candidate is analytical, collaborative, and passionate about helping the organization manage risk while enabling business objectives.

Key Responsibilities

Third-Party Security Risk Management

• Manage the end-to-end third-party security risk assessment process.
• Assess vendor security controls and assurance documentation using ISO 27001, NIST frameworks, and SOC 2 reports.
• Review vendor security documentation, identify risks, and track remediation activities.
• Maintain third-party risk registers and support ongoing vendor monitoring and reporting.

Governance, Risk & Compliance

• Conduct cybersecurity risk assessments and maintain risk registers.
• Support AI governance activities, including risk assessments and inventory management.
• Coordinate cybersecurity policy development, review, approval, and lifecycle activities.
• Support compliance and audit readiness through control testing, evidence collection, and remediation tracking.
• Develop cybersecurity metrics, dashboards, and leadership reporting.
• Identify opportunities to improve and automate GRC processes.

Location

This is a full-time, on-site position based in Yardley, Pennsylvania. Employees are expected to work from the office five days per week, with flexibility in daily start and end times.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, or a related field or equivalent professional experience.
• 3–5 years of experience in cybersecurity, GRC, cyber risk, or third-party risk management.
• Experience conducting security assessments and reviewing vendor security documentation.
• Knowledge of cybersecurity frameworks such as ISO 27001, NIST CSF, and SOC 2.
• Strong analytical, communication, and stakeholder management skills.

Preferred Qualifications

• Certifications such as CISSP, CISM, CISA, CRISC, Security+, or ISO 27001 Lead Implementer/Auditor.
• Experience with GRC platforms such as LogicGate, ServiceNow GRC, Archer, OneTrust, or AuditBoard.
• Familiarity with AI governance frameworks including NIST AI RMF and ISO/IEC 42001.
• Experience supporting cloud security and regulatory compliance initiatives.
• Experience supporting GRC and TPRM activities across multiple countries and cultures.

Additional Job Considerations

This role requires collaboration, teamwork, and regular interaction with business stakeholders, technology teams, and external partners.

What Crown Offers You

• Strong commitment to employee safety and well-being
• Opportunity to build a meaningful career
• Professional development through training and work experiences
• Exposure to global cybersecurity and risk management initiatives

Join us and become part of a team helping to protect Crown's business through effective cybersecurity governance, risk management, and compliance.

• Strong engagement and commitment to the safety of our employees

• The opportunity to build a meaningful career  

• Professional and personal development through training and work experiences   

Working Together Working Together is one of the five pillars that make up our Twentyby30™ program. We aim to value and respect each individual and foster an environment of inclusivity.