Manager Security Compliance and Risk Management

Manager, Security Compliance & Risk Management

• Own and operate the enterprise technology and security risk management program, including risk identification, scoring, tracking, and maintenance of the risk register.
• Lead the risk exception and acceptance process, ensuring documentation, approvals, and periodic review are consistently enforced.
• Drive timely identification, escalation, and resolution of cybersecurity risks and issues across the organization.
• Serve as a trusted advisor to business and technology stakeholders, providing pragmatic, risk‑based guidance that unblocks decisions rather than just flagging concerns.

• Manage, coach, and develop a team of security engineers, including performance management, career growth planning, and hiring.
• Set clear priorities, delegate work effectively, and maintain team capacity across concurrent audit, compliance, and continuous monitoring activities.
• Build a team culture where audit‑readiness and evidence quality are treated as ongoing standards, not last‑minute scrambles.

• Produce metrics, KPIs, and dashboard‑level reporting for senior leadership, including risk dashboards, compliance posture summaries, and control effectiveness metrics.
• Communicate risk and compliance posture clearly to technical and non‑technical stakeholders, translating audit findings and control gaps into concrete next steps.
• Support the CISO in preparing board and executive committee materials on the state of the security and compliance program.

• Carry out management responsibilities in accordance with the organization’s policies, procedures, and applicable laws.
• Conduct interviewing, hiring, and training of employees; plan, assign, and direct work; appraise performance; reward and discipline employees; address complaints and resolve problems.
• Ensure all staff is provided with training and resources needed to perform their jobs to the best possible degree, and provide frequent feedback and coaching.
• Encourage new ideas from staff to foster improvements through innovations, and empower staff to be accountable for their own actions and decisions.

• 6–8 years of progressive experience in information security compliance, risk management, or IT audit.
• 2–3 years of people management or formal team leadership experience.
• Demonstrated experience owning an enterprise risk register and managing the full risk lifecycle.
• Hands‑on experience with control frameworks including NIST CSF and ISO 27001; SOC2 experience strongly preferred.
• Experience with technology‑sector regulatory obligations (e.g., SOC2, GDPR, CCPA), depending on customer base.
• Experience with FedRAMP Continuous Monitoring programs and associated compliance obligations.
• Proven ability to manage audit engagements end‑to‑end and interface directly with internal and external auditors.
• Strong written and verbal communication skills; ability to translate technical risk into business language for executive and non‑technical audiences.
• Bachelor’s degree in information security, Computer Science, Risk Management, or a related field — or equivalent practical experience.

• Relevant certification: CRISC, CISA, CISSP, or CISM.
• Experience with GRC platforms such as Service Now GRC, Archer, One Trust, or Logic Gate.
• Experience supporting customer security reviews and trust/assurance programs.
• Prior experience in a SaaS, cloud, or technology product company.

U.S. National Base Pay Range: $118,300 - $219,800. Geographic differentials may apply in some locations to better reflect local market rates. This job is eligible for an annual incentive bonus.

We are an equal opportunity employer: qualified applicants are considered for and treated during employment without regard to race, color, creed, religion, sex, national origin, citizenship status, disability status, protected veteran status, age, marital status, sexual orientation, gender identity, genetic information, or any other characteristic protected by law. USA Job Seekers: EEO Know Your Rights.