Director, Security Risk Program

What you'll do

• Own strategy, operations, delivery, staffing, and financials for the four program pillars: Risk Assessments, Capability Maturity & Effectiveness, Risk Intelligence, and Cloud Security Risk.
• Lead regulatory and commercial assessments, embed risk reviews into product development, and build AI and cloud security risk capabilities.
• Represent security risk posture to executives, Board committees, regulators, and auditors; drive cross-domain risk alignment and unified quantification.

What they ask for

• 15+ years of experience in security risk management, technology risk, GRC, or a directly related discipline.
• 8+ years managing and developing teams, including managers or senior individual contributors.
• End-to-end ownership of a security or technology risk program across multiple organizations, including methodology, operations, and reporting.
• Experience presenting to executive leadership, partnering with engineering and Central Security, and delivering assessments against external regulatory or certification regimes.

Nice to have

• Relevant certifications (CISSP, CRISC, CISM, CISA) or an advanced degree in a related field.
• Familiarity with EU regulatory frameworks including GDPR/DPIA, RED, DORA, NIS2, or the Cyber Resilience Act.

Pay

$227,000/year to $287,000/year (base salary)

Tools

NIST CSF, CMMI, ISO 27001, FAIR, SOC 2, HIPAA, FDA, EU AI Act

AI focus

Build AI security risk assessment capability, including methodology, tiering, and operations for predicate, model, and rapid assessments; apply automation and AI to scale assessment throughput.