Director, Governance, Risk & Compliance

GRC Leader

Anomali is scaling its compliance program to support an AI-native cybersecurity platform used by governments and enterprises worldwide. We're looking for a hands-on GRC leader who can own and drive our multi-jurisdiction certification portfolio — spanning U.S. federal (FedRAMP), global (ISO 27001, SOC
2), and regional cloud security frameworks (UAE DESC, Saudi Arabia NCA/CCC, Australia IRAP) — while building the scalable compliance infrastructure to support continued international expansion.

This is a builder role, not a maintainer role. You'll be the single point of accountability for keeping our certifications current, audit-ready, and strategically sequenced to unlock new markets and revenue.

• Own the end-to-end GRC roadmap across FedRAMP, ISO 27001, SOC 2, DESC (Dubai Electronic Security Center), Saudi NCA Cloud Cybersecurity Controls (CCC), Australia IRAP, and other regional cloud security/data residency frameworks as they arise
• Prioritize and sequence certification efforts against GTM and revenue targets, in partnership with sales, product, and executive leadership
• Serve as the primary liaison with assessors, auditors, and regulatory bodies (3
  
  PAOs, sponsoring agencies, in-country assessors)

• Manage ongoing FedRAMP authorization activities (ATO maintenance, continuous monitoring, SAR/POA&M remediation) in partnership with the 3
  
  PAO and sponsoring agency
• Own documentation quality (SSP, SAR, POA&M) and escalation management when assessor deliverables fall short

• Maintain and evolve the ISMS, manage internal/external audit cycles, and drive continuous improvement of controls, risk assessments, and policy frameworks

• Own SOC 2 Type II audit readiness and execution (Security, Availability, and Confidentiality trust services criteria) in partnership with the external audit firm
• Manage evidence collection, control testing, and remediation of exceptions across annual audit cycles
• Ensure alignment between SOC 2 controls and overlapping ISO 27001/FedRAMP requirements to avoid duplicated audit effort

• Drive DESC CSP certification for UAE market access. The CSP Security Standard is based on the following international standards, which the candidate should be conversant in:
• ISO/IEC 27001:2013
• ISO/IEC 27002:2013
• ISO/IEC 27017:2015
• ISR:2017 v.02
• CSA Cloud Controls Matrix 3.0.1
• Manage Saudi NCA compliance (ECC/CCC) in coordination with local partners
• Own Australia IRAP assessment process and coordination with registered assessors
• Monitor emerging regional requirements (e.g., additional Gulf, APAC, or EU frameworks) and advise on prioritization

• Build and maintain a unified controls framework that maps overlapping requirements across all frameworks to avoid duplicated effort
• Own enterprise risk register, vendor/third-party risk management, and remediation tracking
• Partner with engineering and product teams to ensure security controls are designed in, not bolted on

• Partner with internal cross-functional teams — IT, Security, Cloud Infrastructure, Engineering, and Product — to own and drive compliance outcomes end-to-end
• Support customer/prospect due diligence (security questionnaires, audit requests, trust portal)
• Partner with legal on regulatory obligations, data residency, and contractual compliance commitments
• Report compliance posture and risk to executive leadership and board as needed

Required Skills/Experience:

• 8+ years in GRC, information security compliance, or related audit/assurance roles, with 3+ years in a leadership capacity
• Direct, hands-on experience with FedRAMP (Moderate or High) as a CSP-side practitioner — not just advisory
• Demonstrated ownership of ISO 27001 certification and ongoing ISMS management
• Demonstrated ownership of SOC 2 Type II audits, from readiness through report delivery
• Experience with at least one Middle East cloud security framework (DESC, Saudi NCA/CCC, or equivalent)
• Familiarity with Australia IRAP assessment process
• Strong working knowledge of cloud security architecture (AWS/Azure/GCP) and how controls map to technical implementation
• Excellent stakeholder…