Technical Security Risk Manager

This role provides risk owners and senior leadership with the insights needed to make informed risk decisions. You will lead complex, ambiguous, or high-visibility risk work, own technical security risk assessments, drive remediation and residual-risk decisions, and represent the risk program in executive and audit forums.

Responsibilities

• Independently lead complex technical risk assessments with minimal oversight, using AI-assisted assessment tools where applicable.
• Serve as a trusted advisor to senior technical leaders and executives on risk posture, prioritization, and tradeoffs.
• Develop and deliver executive-level risk reporting, metrics, and trend analysis, translating technical risk into business impact.
• Own escalation and negotiation on high-risk exception requests and complex remediation disputes.
• Monitor the risk portfolio, identify systemic gaps, and drive process improvements.
• Maintain and improve risk register data quality, setting the standard for other analysts.
• Lead support for internal and external audits, including owning evidence packages and documentation.
• Build strong relationships with engineering leaders and business unit executives.
• Lead difficult conversations with technical and executive stakeholders.
• Mentor and guide junior and mid-level risk analysts.

Minimum Qualifications

• Bachelor's degree or equivalent work experience.
• Professional certification such as GIAC, CISSP, CRISC, CISM, CISA, ISO 27001 LI/LA, CCSK, or CCSP.
• 7-10+ years of hands-on technical risk assessments in a security risk management role.
• Deep cloud technical knowledge (AWS, Azure, GCP).
• Extensive hands-on experience leading assessments and audits against frameworks (NIST CSF/RMF, ISO 27001/27002, ISO 42001, NIST AI RMF).

Preferred Qualifications

• Splunk products, SPL, and building dashboards and reports.
• Python or SQL for risk metrics and program-level automation.
• Mentoring analysts or informally leading a workstream or team.
• Preparing materials for, or presenting in, board-level or executive governance forums.
• Thriving in ambiguity, including defining new processes where none exist.