Hexion Careers

Design and improve information security compliance and enterprise risk management programs. | Bachelor's degree and 7+ years experience in information security compliance or risk management with strong knowledge of ISO, SOC 2, and NIST frameworks. | Company Overview   Hexion is a global leader in specialty chemicals, delivering innovative solutions that improve performance, sustainability, and efficiency across industries. Our manufacturing operations span multiple continents, integrating complex Operational Technology (OT) environments with enterprise IT systems. As regulatory expectations and cyber risk continue to evolve, Hexion is investing in a mature Governance, Risk, and Compliance (GRC) function to protect our business, our customers, and the integrity of our operations. The Compliance and Risk Manager is a critical role in that function — translating regulatory requirements into operational controls and ensuring that risk is measured, managed, and communicated with rigor. Position Overview   The Compliance and Risk Manager is a senior practitioner responsible for designing, implementing, and continuously improving Hexion's information security compliance and enterprise risk management programs. This role requires deep expertise across ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, CIS Controls (Levels 1 and 2), and NIST 800-53, with a clear ability to map controls across frameworks and translate requirements into practical, auditable processes.    This role ensures:  Hexion maintains certification and audit readiness across all applicable compliance frameworks  Enterprise risk is identified, assessed, tracked, and reported with a consistent, repeatable methodology  Controls are operationalized — not just documented — across IT and OT environments  Compliance obligations in manufacturing and OT contexts are understood and addressed  Security and risk posture is communicated clearly to executive leadership and the Board    This is a practitioner's role. The ideal candidate has spent years in the field — conducting audits, writing controls, managing risk registers, and preparing organizations for certification. They bring the authority of deep experience, the discipline of a compliance professional, and the judgment of a senior risk advisor.    Work Environment & Travel  This is a remote-first position with periodic travel to Hexion manufacturing facilities, partner locations, and auditor or certification body engagements as required (~10–15%).    One-Line Summary  Own Hexion's compliance and risk management programs across ISO 27001/17/18, SOC 2, CIS Controls, and NIST — ensuring that controls are real, risks are measured, and the organization is audit-ready every day of the year.  Job Responsibilities   1. Compliance Program Management (ISO 27001 / 27017 / 27018)  Own Hexion's ISO 27001 Information Security Management System (ISMS) and related cloud-specific extensions:  Maintain ISO 27001 certification — manage the full audit lifecycle including internal audits, surveillance audits, and recertification, leveraging ISO 27002.  Apply ISO 27017 controls cloud service security, governing Hexion's obligations as both a cloud service customer and, where applicable, a cloud service provider  Implement ISO 27018 controls for protection of personally identifiable information (PII) in cloud environments  Manage the Statement of Applicability (SoA), control selection rationale, and exceptions register  Drive continuous improvement of the ISMS through management review cycles, nonconformity tracking, and corrective action management  Coordinate with external certification bodies, manage audit evidence packages, and facilitate auditor access    2. SOC 2 Type II Program  Lead Hexion's SOC 2 compliance program across all applicable Trust Services Criteria:  Define and maintain SOC 2 control mapping across Security, Availability, Confidentiality, Processing Integrity, and Privacy categories  Manage common controls library — identify controls that satisfy multiple frameworks simultaneously to reduce compliance overhead  Coordinate readiness assessments and work with external auditors throughout the Type II observation period  Oversee evidence collection workflows, vendor attestation, and control testing documentation  Track and resolve audit exceptions and management responses  Communicate SOC 2 report status to customers and prospects in coordination with sales and legal    3. CIS Controls Implementation (Levels 1 and 2)  Operationalize the CIS Controls as the enterprise's security baseline framework:  Maintain the CIS Controls implementation roadmap, tracking adoption across all 18 control families  Prioritize and govern IG1 (basic cyber hygiene) and IG2 (foundational) controls across IT and OT environments  Partner with security engineering to implement and validate technical controls mapped to CIS safeguards  Measure and report CIS Controls maturity using CIS CSAT or equivalent tooling  Use CIS Controls as a practical lens for remediation prioritization and risk reduction sequencing   Additional Job Responsibilities   4. NIST 800-53 & Enterprise Risk Framework  Maintain fluency in NIST 800-53 and apply it to enterprise risk governance:  Map organizational controls to NIST 800-53 control families to support federal customer requirements, supply chain diligence, and internal governance  Leverage NIST 800-53 as a reference framework for control gap analysis and risk treatment prioritization  Apply NIST Risk Management Framework (RMF) concepts to information system authorization and risk acceptance decisions  Maintain control crosswalks across ISO 27001, SOC 2, CIS Controls, NIST 800-53, and NIST CSF to reduce duplicated effort and provide unified risk visibility and leverage ISO 27005 risk framework.      5. Controls Design, Testing & Assurance  Own the internal controls assurance program:  Design, document, and maintain the enterprise controls library — mapping each control to owning team, testing frequency, and framework coverage  Execute and manage the internal control testing calendar, coordinating evidence collection with control owners across IT, OT, and business functions  Identify control deficiencies, document findings, and drive remediation to closure with defined timelines  Develop control self-assessment (CSA) programs to extend assurance coverage without reliance solely on external audits  Implement GRC tooling to automate evidence collection, control monitoring, and reporting (e.g., ServiceNow GRC, OneTrust, Drata, Vanta)    6. Policy & Standards Governance  Maintain the policy architecture that underpins the compliance program:  Own the information security policy library — drafting, reviewing, publishing, and retiring policies on a defined lifecycle cadence  Ensure policies are mapped to applicable control frameworks and regulatory requirements  Manage policy exception process — intake, risk assessment, approval, and time-bound tracking  Coordinate policy acknowledgment and awareness campaigns with HR and business unit leadership  Competencies Framework fluency — you can navigate ISO 27001, SOC 2, CIS Controls, and NIST without needing to look up the basics  Controls precision — you write controls that are specific, testable, and defensible under audit scrutiny  Risk judgment — you distinguish material risk from noise and help leadership make informed decisions, not just consume reports  Operational credibility — you understand how manufacturing and OT environments work and design compliance requirements that are implementable on the plant floor  Stakeholder influence — you earn trust with engineering, legal, finance, and operations by being practical, clear, and consistent  Audit readiness — you maintain an organization's readiness posture year-round, not in a scramble before the auditor arrives  Leadership Expectations  Serve as the enterprise subject matter expert on information security compliance, risk management, and control frameworks  Build a compliance culture that is embedded in business processes — not bolted on at audit time  Influence cross-functional partners without direct authority — driving accountability for controls across teams that do not report to security  Translate complex regulatory requirements into plain-language business guidance that operational leaders can act on  Represent compliance and risk in vendor evaluations, M&A due diligence, and enterprise architecture discussions  Maintain credibility that comes only from experience — auditors, regulators, and business leaders alike should view this role as the authority on Hexion's compliance posture  Minimum Qualifications   Bachelor's degree in Information Security, Computer Science, Business Administration, or related field (Master's preferred)  7+ years of progressive experience in information security compliance, GRC, or risk management roles  Demonstrated, hands-on experience managing ISO 27001 certification programs — including internal audits, SoA management, and external audit coordination  Deep knowledge of ISO 27017 and ISO 27018 cloud security and privacy controls  Practical SOC 2 Type II experience — control design, evidence collection, auditor management, and exception resolution  Proficiency with CIS Controls (IG1 and IG2) including control mapping, gap assessment, and implementation road mapping  Working knowledge of NIST 800-53 control families and the NIST Risk Management Framework  Experience operating enterprise risk management programs — risk registers, treatment plans, risk reporting to leadership  Ability to build and maintain control crosswalks across multiple frameworks (ISO, SOC 2, CIS, NIST)  Strong written communication — able to produce policy documents, audit evidence packages, and executive risk reports  Preferred Qualifications   Experience with:  OT/ICS environments — familiarity with IEC 62443, NIST SP 800-82, or industrial cybersecurity frameworks  Manufacturing or chemical industry regulatory landscape (OSHA PSM, EPA RMP, REACH, or similar)  Third-party risk management (TPRM) programs and vendor risk assessment methodologies  GDPR, CCPA, or other data privacy regulatory frameworks    Certifications (any of the following valued):  CISM (Certified Information Security Manager)  CRISC (Certified in Risk and Information Systems Control)  ISO 27001 Lead Auditor or Lead Implementer  CISSP, CCSP, or CGEIT  SOC 2 practitioner credentials (AICPA TSC or equivalent)  Other     We are an Equal Opportunity, Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to gender, pregnancy, race, national origin, religion, age, sexual orientation, gender identity, veteran or military status, status as a qualified individual with a disability or any other characteristic protected by law.   To be considered for this position candidates are required to submit an application for employment through our career site and, be at least 18 years of age.  Any offer of employment will be conditioned upon successful completion of a drug test and background investigation, as well as authorization for the Company to conduct additional periodic background checks as required by the Chemical Facility Anti-Terrorism Standards (CFATS) or regulations adopted by the department of Homeland Security or other regulatory agencies. A prior criminal record is not an automatic bar to employment, and the Company will conduct an individualized assessment and reassessment, consistent with applicable law, prior to making any final employment decision.

Lead AI product strategy and delivery for supply chain and procurement, embedding AI into SAP workflows. | 7+ years in product management or supply chain with 3+ years leading AI/analytics products and strong SAP planning knowledge. | Company Overview   Imagine Everything. Build the Future with Hexion.   At Hexion, we push boundaries, rethink possibilities, and create real impact. We activate science to deliver progress—developing breakthrough solutions that strengthen industries, protect communities, and drive a more sustainable future.   This is where bold thinkers, problem-solvers, and innovators come together to shape what’s next. Whether you're engineering advanced materials, transforming manufacturing technologies, or leading strategic innovation, your ideas and actions leave a lasting mark. We cultivate an inclusive culture of growth, collaboration, and accountability, ensuring every contribution propels us forward.   We don’t follow the status quo—we challenge it, disrupt it, and improve it. Every role at Hexion is part of something bigger.   We invest in innovation, sustainability, and continuous development—equipping you with the tools, training, and opportunities to excel. With an unwavering commitment to safety, partnership, belonging, and impact, we empower you to lead change and strengthen industries worldwide.   Your Future Starts Here.     If you’re ready to push limits, reimagine what’s possible, and create the extraordinary, Hexion is where you belong.    Anything is possible when you imagine everything. Role Mission   Own the end-to-end AI product strategy and delivery for Hexion’s Supply Chain and Procurement functions, turning operational data into competitive advantage. Define, prioritize, and drive the AI use caseroadmap across planning, logistics, procurement, and supplier management — from AI-driven spend intelligence and supplier risk sensing to Digital Bulk predictive delivery and SC Command Centerorchestration.  This role sits at the heart of Hexion’s supply chain andprocurement transformation. Owning six procurement AI initiativesand the SC Command Center, the Senior PM will turn operationaldata into durable cost advantage, resilience, and serviceexcellence Job Responsibilities   Own and sequence the AI product roadmap across Procurement (Spend Intelligence, Contract Intelligence, Category Strategy Copilot, Guided Sourcing, Intake-to-Procure Orchestration, Supplier Risk Sensing) and Supply Chain (Digital Fulfillment, Command Center, demand sensing, logistics optimization).​ Serve as business owner for each AI initiative from discovery through deployment and adoption — writing requirements, running sprint reviews, managing go/no-go decisions, and tracking value realization for each use case.​ Lead buy/build/co-develop decisions for SC & Procurement AI: evaluate vendors (GEP, Coupa, Icertis, Keelvar, Resilinc, Everstream, Zip) against internal build options with clear total cost-of-ownership and capability analysis.​ Embed AI into SAP S/4HANA, APO, and TMS workflows; partner with IT and data engineering to connect AI outputs to procurement and logistics execution systems with reliable, auditable data pipelines.​ Build AI fluency and drive adoption across Supply Chain and Procurement teams — training playbooks, communities of practice, and reinforcement mechanisms so planners, buyers, and logistics managers act on AI-assisted insights.​ Champion responsible AI governance: ensure demand sensing, pricing, supplier risk, and logistics models are explainable and auditable; maintain KPI dashboards and report value realization to executive sponsor Knowledge, Skills, Attributes and Experience (KSAEs)   7+ years in product management, supply chain, or procurement; 3+ yearsleading AI/analytics products in B2B industrial or manufacturing settings.​ Strong grasp of supply chain planning and procurement, including demandsensing, S&OP, inventory, logistics, sourcing, contracting, and suppliermanagement.​ Able to convert business workflows into AI product requirements, including userstories, MVP scope, acceptance criteria, and KPI frameworks tied to value.​ Familiar with AI/ML in supply chain and procurement, including forecasting,optimization, contract intelligence, and risk sensing.​ Experience assessing and managing SaaS AI vendors using structuredbuy/build/co-develop decisions.​ Proficient in SAP and planning environments (SAP IBP, S/4HANA, APO, TMS,o9, Kinaxis), with the ability to connect AI outputs to execution systems and datapipelines.​ Change management capability to drive adoption with planners, buyers, andoperations teams. (Preferred)​ Financial acumen to build ROI cases, track realized value, and justify AIinvestments. (Preferred) Supply chain-first product thinker — connects AI capability to operational outcomes: cost, service level, resilience, and procurement efficiency.​ Commercially curious and analytically sharp — equally comfortable in a vendor demo, a planner’s S&OP meeting, and a data science sprint review.​ Execution-focused and delivery-driven — moves use cases from idea to production without losing sight of adoption, change management, and measurable ROI.​ Collaborative and credible — earns trust with supply chain directors, procurement leaders, and data scientists alike through deep domain knowledge and intellectual honesty. 10+ years of progressive product management or supply chain/procurement operations experience; at least 3 years directly owning AI, analytics, or optimization products in B2B industrial settings.​ Proven record delivering AI/ML products in supply chain or procurement contexts — from demand forecasting and logistics optimization to spend analytics and contract intelligence — with quantified cost or service-level outcomes.​ Experience in specialty chemicals, bulk chemicals, or industrial manufacturing strongly preferred; familiarity with multi-plant logistics networks, bulk delivery optimization, raw material procurement complexity, and SAP/APO a significant plus. Other We are an Equal Opportunity, Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to gender, minority status, sexual orientation, gender identity, protected veteran status, status as a qualified individual with a disability or any characteristic protected by law.   In order to be considered for this position candidates are required to submit an application for employment through our career site, be at least 18 years of age, willing to take a drug test, submit to a background investigation as part of the selection process, as well as additional periodic background checks as required by the Chemical Facility Anti-Terrorism Standards (CFATS) or regulations adopted by the department of Homeland Security or other regulatory agencies.   Candidates are required to have unrestricted authorization to work in the United States.   If currently an employee of the Company, you must have current satisfactory work performance and in most cases, have been in your current role for 18 months. Disclaimer: We are not accepting unsolicited assistance from search firms/employment agencies for this employment opportunity. Please, no phone calls or emails to any employee about this position. All resumes submitted by search firms/employment agencies to any employee of the Company via email, the Internet, or in any other form and/or method without a valid written search firm agreement in place for this position will be deemed the sole property of the Company; no fee will be paid in the event a candidate is hired by the Company as a result of the unsolicited referral or through other means.