Manager, CyberSecurity Risk Management

Accountabilities: Cybersecurity Risk Program Management: Support day-to-day execution of the cybersecurity risk management program, coordinating assessments, remediation initiatives, timelines, dependencies, and deliverables across multiple teams. Risk Assessment and Analysis: Conduct and support enterprise, technical, cloud, application, and third-party risk assessments. Evaluate inherent and residual risks, gather supporting evidence, validate security controls, and translate technical findings into clear business-impact statements. Risk Register and Remediation Tracking: Maintain accurate risk registers, including ownership, status, target dates, treatment decisions, and mitigation plans. Follow up regularly with risk owners, monitor progress, resolve or escalate blockers, and drive remediation activities through closure. Risk Governance and Reporting: Support risk committee meetings, risk acceptance processes, exception reviews, and escalation procedures. Prepare leadership updates, dashboards, and reports that communicate cybersecurity risk exposure, remediation progress, and emerging concerns. Metrics and Risk Quantification: Collect and analyze key performance indicators (KPIs) and key risk indicators (KRIs), identify trends, and contribute to risk quantification efforts that help prioritize initiatives according to business and financial impact. Compliance and Framework Alignment: Help map risk management activities to applicable regulatory obligations and industry frameworks, including ISO 27001, SOC 2, FedRAMP, NIST CSF, NIST SP 800-53, PCI DSS, and HIPAA, while monitoring emerging requirements such as DORA, NIS2, and the EU AI Act. Cross-Functional Coordination: Collaborate with Security, Engineering, Product, IT, Legal, Procurement, and Finance to coordinate risk initiatives, align stakeholders, track decisions, and ensure timely delivery of remediation commitments. Process Improvement and Automation: Support the implementation and adoption of governance, risk, and compliance (GRC) tools, standardized workflows, and automation solutions. Help pilot AI-enabled use cases, including risk intake triage, evidence mapping, and automated status summaries, with appropriate human oversight and governance. Continuous Improvement: Identify gaps in existing risk management processes and recommend improvements to assessment consistency, reporting accuracy, operational efficiency, and overall program effectiveness. Requirements Professional Experience: At least 8 years of experience in cybersecurity risk management or governance, risk, and compliance (GRC), including a minimum of 3 years in program or project management. Program Management Expertise: Demonstrated ability to plan and coordinate cross-functional initiatives, manage dependencies and timelines, estimate effort, monitor deliverables, communicate status, and ensure accountability for results. Cybersecurity Risk Management: Experience supporting or scaling a cybersecurity risk management program, preferably within a technology, SaaS, or cloud-based organization operating in a fast-paced environment. Risk Methodologies and Frameworks: Working knowledge of risk management methodologies such as NIST Risk Management Framework (RMF), NIST SP 800-30, NIST SP 800-37, ISO 27005, and COBIT, along with security frameworks including ISO 27001/27002, SOC 2, FedRAMP, NIST CSF, NIST SP 800-53, CIS Controls, PCI DSS, and HIPAA. Technical Security Knowledge: Sufficient understanding of cloud security, identity management, network security, and application security to engage effectively with engineering teams, assess technical risks, and follow remediation plans. GRC Tools and Reporting: Hands-on experience with project management and reporting tools such as Jira, Confluence, and Tableau, with the ability to maintain risk documentation and communicate progress through structured reporting. Analytical and Communication Skills: Strong analytical thinking, problem-solving, organization, and attention to detail, combined with excellent written and verbal communication skills and the ability to translate complex technical risks into business-relevant insights. Stakeholder Management: Proven ability to influence stakeholders, build consensus, and coordinate initiatives across teams without relying on direct reporting authority. Education: A bachelor's degree in Security, Computer Science, Management Information Systems, or a related discipline, or equivalent practical experience. Benefits Competitive Base Salary: United States — San Francisco Bay Area, Washington, D.C. metro area, New York City, and Seattle: $181,600–$272,400 per year . Other U.S. locations and remote positions: $163,400–$245,200 per year . Additional Compensation: Eligibility for performance-based bonuses and equity, subject to the applicable compensation plan. Remote Flexibility: Remote work opportunities within the United States. Professional Growth: Opportunities to develop expertise in cybersecurity risk management, cloud security, regulatory compliance, and AI-enabled risk operations. Collaborative Environment: Work with multidisciplinary teams across security, engineering, product, and business functions to strengthen enterprise security and resilience. Meaningful Impact: Contribute to the protection of critical data, systems, and cloud environments while helping the organization manage evolving cybersecurity threats. Inclusive Culture: Join an environment committed to equal opportunity, inclusion, professional development, and providing reasonable accommodations throughout employment and the application process.