Senior Enterprise Risk Manager

Denver, CO or Long Beach, CA or Washington, DC

A new space race has begun. True Anomaly seeks those with the talent and ambition to build innovative technology that solves the next generation of engineering, manufacturing, and operational challenges for space security and sustainability.

The peaceful use of space is essential for continued prosperity on Earth—from communications and finance to navigation and logistics. True Anomaly builds innovative technology at the intersection of spacecraft, software, and AI to enhance the capabilities of the U.S., its allies, and commercial partners. We safeguard global security by ensuring space access and sustainability for all.

• Be the offset. We create asymmetric advantages with creativity and ingenuity
• What would it take? We challenge assumptions to deliver ambitious results
• It’s the people. Our team is our competitive advantage and we are better together

We are seeking a Senior Enterprise Risk Manager to build, lead, and mature two distinct but interconnected lines of effort:
Enterprise Risk Management (ERM) and Third‑Party Vendor Risk Management (TPVRM). This is a foundational leadership role for a seasoned risk professional who thrives in fast‑moving, mission‑critical environments and understands the unique demands of operating at the intersection of defense, aerospace, and commercial SaaS.

• Design, implement, and continuously mature a scalable enterprise risk management program aligned to NIST RMF, ISO 31000, and applicable DoD frameworks.
• Apply FAIR methodology to quantify cyber and operational risk in financial terms, enabling data‑driven prioritization and executive‑level risk decision‑making.
• Leverage OCTAVE or similar threat‑centric methodologies to lead structured risk assessments that identify critical assets, threat profiles, and organizational vulnerabilities.
• Establish and maintain an enterprise risk register, risk appetite statements, and risk tolerance thresholds in collaboration with executive leadership and the Board (as applicable).
• Lead recurring risk identification, assessment, and prioritization processes across business units, ensuring alignment between operational risk posture and strategic objectives.
• Develop and maintain executive‑ready risk dashboards, KPI/KRI reporting, and program metrics using tools such as Jira, Confluence, GRC platforms, and MS Project.
• Conduct and coordinate internal audits and risk assessments to ensure adherence to DoD compliance standards, including NIST SP 800‑53 Rev. 5, NIST SP 800‑171, RMF (IL5 and IL6), and CMMC Level 3.
• Support audit readiness activities including pre‑assessment preparation, evidence collection, POA&M management, and post‑audit remediation planning.
• Develop, implement, and mature information security and enterprise risk policies, standards, and guidelines based on industry best practices.
• Serve as a primary point of contact for internal stakeholders, executive leadership, and external assessors, certification bodies, and government partners.

• Build and lead a formalized Third‑Party Vendor Risk Management program, establishing vendor classification tiers, risk assessment methodologies, and ongoing monitoring cadences.
• Define and operationalize vendor onboarding risk assessments, including security questionnaires, compliance validations, and contractual risk controls (e.g., SLAs, right‑to‑audit clauses, data handling requirements).
• Maintain a vendor risk inventory and lifecycle management process covering initial due diligence through offboarding, ensuring continuous visibility into third‑party risk exposure.
• Collaborate with legal, procurement, and supply chain teams to embed risk criteria into vendor selection, contract negotiation, and renewal processes.
• Monitor third‑party vendors for changes in risk posture, including cybersecurity incidents, financial instability, regulatory actions, and ITAR/export control concerns.
• Develop vendor risk reporting and executive‑level dashboards to provide ongoing transparency into third‑party exposure across critical suppliers and technology partners.
• Ensure TPVRM program…