VP, Information Security
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes a job summary, essential duties & responsibilities (multiple sub-sections), candidate profile (experience and expertise), competencies (duplicate). Also location: "This position will be located at the company’s headquarters in Sandy Springs, Georgia." No explicit Pay, Benefits, Schedule. So we should not create those sections. We need to include About the role? The job summary could be considered About the role. Could use About the role
with paragraph(s). Responsibilities: we have Essential Duties & Responsibilities (multiple bullet-like paragraphs). We'll need to convert each duty into - . The duties are long sentences; we can split by sentences or keep as list items each duty. Probably each bullet is a duty; we can treat each paragraph as a list item. There are many paragraphs under Essential Duties & Responsibilities, each starting with a bold heading like "Enterprise Cybersecurity Strategy, Governance, and Leadership:" then sentences. We could make each bold heading as a list item with sub-items? Simpler: treat each paragraph as a list item. We'll need to preserve all substantive info. Also there is "Essential Duties (Continued)" which continues list.
We also have Candidate Profile (Qualifications) and Competencies (maybe Skills). We'll map Candidate Profile to Requirements or Qualifications. Since they ask for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We can combine Requirements and Qualifications maybe. But we need to follow instruction: use heading only when posting has real specific content. We have content for About the role (job summary). Responsibilities (essential duties). Requirements/Qualifications (candidate profile). Skills maybe from competencies (but it's duplicate). Could treat Competencies as Skills. We'll include Skills section.
We must not repeat job title as heading. No Job ID etc.
We must remove boilerplate: disclaimer, etc. Also remove "Competencies" duplicate? We'll keep as Skills.
We need to output only HTML fragment.
Let's extract content.
About the role: The job summary paragraph(s):
"Reporting to the SVP & Chief Information Officer (CIO), the Vice President, Cybersecurity & Chief Information Security Officer (CISO) will lead Graphic Packaging’s global cybersecurity, technology risk, and operational resilience agenda. As the company’s senior cybersecurity executive, the CISO will protect enterprise information, digital products, cloud platforms, manufacturing operations, operational technology (OT), connected devices, and the extended third-party ecosystem while enabling innovation, growth, and reliable operations. The CISO will advise executive leadership and the Board on cyber risk, define risk appetite and tolerance with business leaders, and translate technical exposure into business, financial, safety, operational, legal, and reputational impact. This leader will establish an integrated, risk-based program aligned to recognized frameworks and evolving regulatory requirements; strengthen cyber resilience across IT and OT; govern the secure adoption of artificial intelligence, including generative and agentic AI; and embed security, privacy, and resilience by design across technology, procurement, product development, and business transformation."
That's one paragraph; we can keep as
.
Responsibilities: list of duties. Let's extract each paragraph under Essential Duties & Responsibilities and Essential Duties (Continued). We'll treat each as list item.
Paragraphs:
1. "Enterprise Cybersecurity Strategy, Governance, and Leadership: Define and execute a multi-year global cybersecurity and resilience strategy aligned with business priorities, enterprise risk appetite, technology modernization, and recognized frameworks such as NIST Cybersecurity Framework 2.0 and ISO/IEC 27001."
2. "Own cybersecurity governance, policies, standards, control architecture, exceptions, and assurance across corporate IT, cloud, software, data, OT, industrial control systems, IoT, and digital products."
3. "Provide clear, decision-oriented reporting to the CIO, executive leadership, Audit Committee, and Board, including quantified risk, material exposures, investment trade-offs, control effectiveness, incident readiness, and remediation progress."
4. "Lead, develop, and retain a high-performing global cybersecurity organization and establish clear accountability across a federated network of business, IT, engineering, legal, privacy, compliance, internal audit, physical security, and operational stakeholders."
5. "Cyber Risk, Resilience, And Incident Management Establish an enterprise cyber risk management program that continuously identifies, quantifies, prioritizes, treats, accepts, and reports risk in business and financial terms."
6. "Lead continuous threat, attack-surface, exposure, and vulnerability management using intelligence, adversary-informed testing, secure configuration, and risk-based remediation across IT and OT environments."
7. "Maintain and exercise enterprise incident response, crisis management, cyber recovery, ransomware, data breach, and business continuity playbooks, including executive and Board simulations and coordination with legal counsel, insurers, law enforcement, regulators, customers, and key suppliers."
8. "Define minimum viable operations, recovery priorities, immutable backup and restoration requirements, and measurable recovery objectives; regularly validate the organization’s ability to restore trusted operations following destructive cyber events."
9. "Oversee security operations, detection engineering, threat intelligence, digital forensics, incident response, and managed security partners, with automation and AI used responsibly to improve speed, coverage, and analyst effectiveness."
10. "Set and report key risk, performance, resilience, and control indicators that demonstrate business outcomes, security return on investment, trends, and accountability."
11. "AI, Data, Identity, Cloud, And Secure Technology Enable Co-lead enterprise AI security and risk governance for predictive, generative, and agentic AI, including model and use-case inventory, data protection, human oversight, red-teaming, prompt and model attack defenses, secure AI development, third-party model risk, shadow AI monitoring, and lifecycle assurance."
12. "Extend identity governance to employees, privileged users, contractors, service accounts, workloads, machines, and AI agents through phishing-resistant authentication, least privilege, just-in-time access, continuous authorization, and strong secrets management."
13. "Embed secure-by-design and privacy-by-design practices into cloud architecture, applications, APIs, data platforms, DevSecOps, software acquisition, and digital products."
14. "Partner with enterprise architecture and technology leaders to advance Zero Trust principles, data security, encryption, key management, data loss prevention, cloud security posture, and secure configuration across hybrid and multi-cloud environments."
15. "OT, Product, Third-Party, and Supply Chain Security: Own the cyber risk strategy for manufacturing sites, OT, industrial control systems, IoT, engineering environments, and cyber-physical operations, balancing safety, availability, quality, and production requirements."
16. "Establish asset visibility, segmentation, secure remote access, monitoring, vulnerability management, engineering change controls, incident response, and recovery requirements for OT environments, in partnership with plant and engineering leadership."
17. "Strengthen third-party and fourth-party risk management across suppliers, software, cloud, managed services, logistics, and connected products through tiering, due diligence, contractual controls, continuous monitoring, concentration-risk analysis, and tested exit and recovery plans."
18. "Set secure procurement and software supply-chain requirements, including secure development evidence, support and patch commitments, vulnerability disclosure, component transparency, and security-by-default expectations."
19. "Regulatory Compliance, Assurance, And Executive Accountability Maintain a global cyber regulatory and contractual obligations framework covering applicable privacy, securities, critical-infrastructure, product-security, and breach-notification requirements, including SOX, GDPR, NIS2, and the EU Cyber Resilience Act where applicable."
20. "Partner with Legal, Privacy, Compliance, Finance, Internal Audit, and Disclosure Committees to support timely escalation, materiality assessment, regulatory reporting, customer notification, litigation readiness, and defensible evidence."
21. "Oversee independent assessments, penetration testing, red and purple teaming, control testing, audits, certifications, and remediation governance; ensure systemic issues and overdue risks are transparently escalated."
22. "Develop the enterprise’s cryptographic inventory and risk-based transition roadmap for post-quantum readiness, prioritizing long-lived sensitive data, critical trust services, and high-impact systems."
23. "Manage the global cybersecurity operating and capital budgets, workforce, sourcing strategy, cyber insurance support, and partner portfolio; prioritize investments using risk reduction, resilience, business value, and total cost of ownership."
24. "Build a measurable security culture through role-based education, executive and Board engagement, phishing-resistant practices, insider-risk coordination, and positive reinforcement of secure behaviors."
25. "Drive simplification, automation, platform rationalization, skills development, succession planning, and continuous improvement across the cybersecurity program."
Also location: "This position will be located at the company’s headquarters in Sandy Springs, Georgia." Could be part of About the role or separate? Could add a paragraph after responsibilities maybe as part of About the role? Probably include as a separate short paragraph under About the role or as its own? The instruction: include sections only when posting has real specific content. Location is specific but not a standard heading; we could incorporate into About the role paragraph. We'll add a sentence at end of About the role: "This position will be located at the company’s headquarters in Sandy Springs, Georgia."
Now Candidate Profile (Qualifications/Requirements). Let's extract:
"The successful candidate will bring the following experience and expertise: Bachelor’s degree in cybersecurity, information technology, engineering, computer science, risk management, or a related discipline; advanced degree preferred.At least 15 years of progressive cybersecurity, technology risk, or related leadership experience, including significant tenure leading a complex global enterprise security function; public-company and manufacturing experience strongly preferred.Demonstrated experience securing OT, industrial control systems, manufacturing assets, IoT, and cyber-physical environments without compromising safety or operational continuity.Proven ability to build and transform enterprise cybersecurity programs across strategy, governance, security operations, incident response, identity, cloud, applications, data, third parties, resilience, and regulatory compliance.Practical experience governing AI risk and securing generative and agentic AI, including data flows, models, agents, non-human identities, AI-enabled software development, and AI-supported security operations.Deep knowledge of relevant frameworks and practices, Zero Trust, secure software development, and business continuity and disaster recovery.Strong understanding of applicable global requirements such as SOX, GDPR, SEC cybersecurity disclosure expectations, NIS2, the EU Cyber Resilience Act, and other sector- or geography-specific obligations.Demonstrated success quantifying cyber risk, presenting to executive leadership and Boards, leading through major incidents, influencing without direct authority, and making balanced decisions in ambiguous, high-pressure environments.Recognized cybersecurity or risk certifications such as CISSP, CISM, CRISC, or equivalent are preferred."
We can split into list items for each sentence or each clause. We'll make each sentence as
- . Let's split by periods.
Sentences:
1. Bachelor’s degree in cybersecurity, information technology, engineering, computer science, risk management, or a related discipline; advanced degree preferred.
2. At least 15 years of progressive cybersecurity, technology risk, or related leadership experience, including significant tenure leading a complex global enterprise security function; public-company and manufacturing experience strongly preferred.
3. Demonstrated experience securing OT, industrial control systems, manufacturing assets, IoT, and cyber-physical environments without compromising safety or operational continuity.
4. Proven ability to build and transform enterprise cybersecurity programs across strategy, governance, security operations, incident response, identity, cloud, applications, data, third parties, resilience, and regulatory compliance.
5. Practical experience governing AI risk and securing generative and agentic AI, including data flows, models, agents, non-human identities, AI-enabled software development, and AI-supported security operations.
6. Deep knowledge of relevant frameworks and practices, Zero Trust, secure software development, and business continuity and disaster recovery.
7. Strong understanding of applicable global requirements such as SOX, GDPR, SEC cyber
. Responsibilities: list of duties. Let's extract each paragraph under Essential Duties & Responsibilities and Essential Duties (Continued). We'll treat each as list item. Paragraphs: 1. "Enterprise Cybersecurity Strategy, Governance, and Leadership: Define and execute a multi-year global cybersecurity and resilience strategy aligned with business priorities, enterprise risk appetite, technology modernization, and recognized frameworks such as NIST Cybersecurity Framework 2.0 and ISO/IEC 27001." 2. "Own cybersecurity governance, policies, standards, control architecture, exceptions, and assurance across corporate IT, cloud, software, data, OT, industrial control systems, IoT, and digital products." 3. "Provide clear, decision-oriented reporting to the CIO, executive leadership, Audit Committee, and Board, including quantified risk, material exposures, investment trade-offs, control effectiveness, incident readiness, and remediation progress." 4. "Lead, develop, and retain a high-performing global cybersecurity organization and establish clear accountability across a federated network of business, IT, engineering, legal, privacy, compliance, internal audit, physical security, and operational stakeholders." 5. "Cyber Risk, Resilience, And Incident Management Establish an enterprise cyber risk management program that continuously identifies, quantifies, prioritizes, treats, accepts, and reports risk in business and financial terms." 6. "Lead continuous threat, attack-surface, exposure, and vulnerability management using intelligence, adversary-informed testing, secure configuration, and risk-based remediation across IT and OT environments." 7. "Maintain and exercise enterprise incident response, crisis management, cyber recovery, ransomware, data breach, and business continuity playbooks, including executive and Board simulations and coordination with legal counsel, insurers, law enforcement, regulators, customers, and key suppliers." 8. "Define minimum viable operations, recovery priorities, immutable backup and restoration requirements, and measurable recovery objectives; regularly validate the organization’s ability to restore trusted operations following destructive cyber events." 9. "Oversee security operations, detection engineering, threat intelligence, digital forensics, incident response, and managed security partners, with automation and AI used responsibly to improve speed, coverage, and analyst effectiveness." 10. "Set and report key risk, performance, resilience, and control indicators that demonstrate business outcomes, security return on investment, trends, and accountability." 11. "AI, Data, Identity, Cloud, And Secure Technology Enable Co-lead enterprise AI security and risk governance for predictive, generative, and agentic AI, including model and use-case inventory, data protection, human oversight, red-teaming, prompt and model attack defenses, secure AI development, third-party model risk, shadow AI monitoring, and lifecycle assurance." 12. "Extend identity governance to employees, privileged users, contractors, service accounts, workloads, machines, and AI agents through phishing-resistant authentication, least privilege, just-in-time access, continuous authorization, and strong secrets management." 13. "Embed secure-by-design and privacy-by-design practices into cloud architecture, applications, APIs, data platforms, DevSecOps, software acquisition, and digital products." 14. "Partner with enterprise architecture and technology leaders to advance Zero Trust principles, data security, encryption, key management, data loss prevention, cloud security posture, and secure configuration across hybrid and multi-cloud environments." 15. "OT, Product, Third-Party, and Supply Chain Security: Own the cyber risk strategy for manufacturing sites, OT, industrial control systems, IoT, engineering environments, and cyber-physical operations, balancing safety, availability, quality, and production requirements." 16. "Establish asset visibility, segmentation, secure remote access, monitoring, vulnerability management, engineering change controls, incident response, and recovery requirements for OT environments, in partnership with plant and engineering leadership." 17. "Strengthen third-party and fourth-party risk management across suppliers, software, cloud, managed services, logistics, and connected products through tiering, due diligence, contractual controls, continuous monitoring, concentration-risk analysis, and tested exit and recovery plans." 18. "Set secure procurement and software supply-chain requirements, including secure development evidence, support and patch commitments, vulnerability disclosure, component transparency, and security-by-default expectations." 19. "Regulatory Compliance, Assurance, And Executive Accountability Maintain a global cyber regulatory and contractual obligations framework covering applicable privacy, securities, critical-infrastructure, product-security, and breach-notification requirements, including SOX, GDPR, NIS2, and the EU Cyber Resilience Act where applicable." 20. "Partner with Legal, Privacy, Compliance, Finance, Internal Audit, and Disclosure Committees to support timely escalation, materiality assessment, regulatory reporting, customer notification, litigation readiness, and defensible evidence." 21. "Oversee independent assessments, penetration testing, red and purple teaming, control testing, audits, certifications, and remediation governance; ensure systemic issues and overdue risks are transparently escalated." 22. "Develop the enterprise’s cryptographic inventory and risk-based transition roadmap for post-quantum readiness, prioritizing long-lived sensitive data, critical trust services, and high-impact systems." 23. "Manage the global cybersecurity operating and capital budgets, workforce, sourcing strategy, cyber insurance support, and partner portfolio; prioritize investments using risk reduction, resilience, business value, and total cost of ownership." 24. "Build a measurable security culture through role-based education, executive and Board engagement, phishing-resistant practices, insider-risk coordination, and positive reinforcement of secure behaviors." 25. "Drive simplification, automation, platform rationalization, skills development, succession planning, and continuous improvement across the cybersecurity program." Also location: "This position will be located at the company’s headquarters in Sandy Springs, Georgia." Could be part of About the role or separate? Could add a paragraph after responsibilities maybe as part of About the role? Probably include as a separate short paragraph under About the role or as its own? The instruction: include sections only when posting has real specific content. Location is specific but not a standard heading; we could incorporate into About the role paragraph. We'll add a sentence at end of About the role: "This position will be located at the company’s headquarters in Sandy Springs, Georgia." Now Candidate Profile (Qualifications/Requirements). Let's extract: "The successful candidate will bring the following experience and expertise: Bachelor’s degree in cybersecurity, information technology, engineering, computer science, risk management, or a related discipline; advanced degree preferred.At least 15 years of progressive cybersecurity, technology risk, or related leadership experience, including significant tenure leading a complex global enterprise security function; public-company and manufacturing experience strongly preferred.Demonstrated experience securing OT, industrial control systems, manufacturing assets, IoT, and cyber-physical environments without compromising safety or operational continuity.Proven ability to build and transform enterprise cybersecurity programs across strategy, governance, security operations, incident response, identity, cloud, applications, data, third parties, resilience, and regulatory compliance.Practical experience governing AI risk and securing generative and agentic AI, including data flows, models, agents, non-human identities, AI-enabled software development, and AI-supported security operations.Deep knowledge of relevant frameworks and practices, Zero Trust, secure software development, and business continuity and disaster recovery.Strong understanding of applicable global requirements such as SOX, GDPR, SEC cybersecurity disclosure expectations, NIS2, the EU Cyber Resilience Act, and other sector- or geography-specific obligations.Demonstrated success quantifying cyber risk, presenting to executive leadership and Boards, leading through major incidents, influencing without direct authority, and making balanced decisions in ambiguous, high-pressure environments.Recognized cybersecurity or risk certifications such as CISSP, CISM, CRISC, or equivalent are preferred." We can split into list items for each sentence or each clause. We'll make each sentence as