Director; Governance, Risk & Compliance

Cosm; Los Angeles (CA); On-site; USD 210,000 - 225,000; Full time

Job summary

Cosm is building its information security program and this role owns the governance backbone. The position focuses on risk management, audits, and vendor security across enterprise environments in a fast‑growing immersive tech company.

Responsibilities include maintaining the risk register, ensuring policy alignment, and coordinating internal audits and external assessments. The role requires deep knowledge of NIST CSF 2.0, ISO 27001, and SOX ITGC.

Qualifications

• 8–12 years in IT governance, risk, and compliance.
• Hands-on experience operating and maturing risk registers, risk assessments, gap analyses, and remediation.
• Experience owning a third-party risk program and vendor security attestations.
• Experience producing board- or audit-committee level reporting on risk posture and remediation.

Responsibilities

• Operate and mature the risk register with ownership and closure tracking.
• Verify that engineering and IT controls are designed correctly and functioning.
• Plan and run internal audits, support external assessments, and due diligence.
• Own the vendor security program end to end from intake to monitoring.
• Author and maintain security policies and map them to frameworks.
• Design and track a metrics framework with KPIs and KRIs tied to risk appetite.
• Provide risk context for incident reviews and post-incident findings.

Skills

GRC leadership

Risk assessment

SOX ITGC

Internal audits

Third-party risk

Education

Bachelor's degree

Tools

Vanta

Job description

Cosm is a global technology company that brings experiences to life in immersive environments. We help our partners create spaces and content that blur the lines of real and virtual across three primary markets: Sports and Entertainment, Science and Education, and Parks and Attractions. Cosm was born from the fusion of some of the greatest innovators in the history of technology. Evans & Sutherland, Spitz, Inc., and Cosm Immersive combined forces to power the immersive experiences of the future as Cosm. Innovation is in our DNA.

Summary

Cosm is building its information security program, and this role owns the governance backbone. We operate immersive venues, produce and handle premium content under studio and Trusted Partner Network security requirements, and we are building toward the control maturity that comes with rapid growth and external scrutiny. That combination means regulatory exposure and audit scrutiny from partners who take content security seriously.

Responsibilities

Enterprise cyber risk

Operate and mature the risk register from initial population to a sustained program: scoring methodology, business impact analysis, and treatment-versus-acceptance decisions tracked to closure with named owners. Facilitate the executive risk review cycle, surfacing residual risks that exceed appetite. Maintain the risk appetite framework so that scoring, escalation thresholds, and "exceeds appetite" triggers stay aligned to what the Audit Committee has approved, and support its annual review.

Independent assurance

Verify that controls built and operated by Engineering, Security Engineering, and IT are designed correctly and working, maintaining separation between those who build controls and those who assure them. This includes auditing technical standards authored by Security Engineering, such as firewall and hardening baselines, against policy and framework requirements. Own the control evidence program in Vanta: every control with an assigned owner and defined evidence, collected on cadence, with coverage and freshness monitored and gaps closed ahead of audits. Track control deficiencies to remediation and report residual exposure to leadership.

Compliance and audit readiness

NIST CSF 2.0, SOX ITGC, and TPN. Plan and run internal audits, perform and document control testing, support external assessments, and lead customer and partner security due diligence.

Third-party risk

Own the vendor security program end to end: intake, security review, risk rating, attestation collection, and ongoing monitoring across the vendor lifecycle. Partner with Legal and Procurement to get security requirements into onboarding and contracts.

Policy and control framework

Author and maintain security policies, and drive them through ratification, distribution, and tracked acknowledgment where they bind individuals, including contractors before access is granted. Manage the control catalog that maps Cosm's controls to its frameworks, and coordinate control ownership across the organization. Technical standards are authored by Security Engineering; you review them for policy alignment and audit against them.

Security awareness

Own the awareness and role-based training program end to end: content, cadence, delivery, phishing simulation, completion tracking, and role-specific training for administrators, privileged users, and developers.

Board reporting and metrics

Design the metrics framework, KPIs and KRIs tied to risk appetite rather than activity volume. Define the escalation triggers that force an off-cycle report to the Audit Committee, such as a critical vulnerability past its SLA or a control failure in a high-criticality area. Produce the quarterly Audit Committee package: maturity movement with rationale, top gaps with owners and dates, incidents mapped to previously identified gaps, and resourcing tied to specific exposures. Present to senior leadership, the Cybersecurity Executive Steering Committee, and the Audit Committee.

Incident support

Provide risk, control, and impact context to the decision-makers assessing whether an incident is material, and own the control and maturity findings that come out of post-incident review.

Experience

• 8 to 12 years in IT governance, risk, and compliance, including leading GRC programs or major initiatives in enterprise environments
• Hands-on experience operating and maturing risk registers, running risk assessments, gap analyses, and business impact analyses, and driving treatment decisions to closure
• Independent control testing experience supporting SOX ITGC
• Experience planning and executing internal audits
• Experience owning a third-party risk program, including review of vendor security attestations
• Experience running continuous-compliance and evidence collection in a GRC platform. We use Vanta
• Expertise authoring IT and security policies that meet regulatory requirements, and running them through review, ratification, and acknowledgment
• Track record producing board or audit-committee-level reporting on maturity, risk posture, and remediation, and designing metrics tied to risk appetite
• Experience building training and awareness programs
• Deep working knowledge of NIST CSF 2.0 and 800-53; familiarity with SOC 2, ISO 27001, COBIT, and CIS Controls
• Ability to explain complex risk to non-technical senior stakeholders and influence decisions
• Bachelor's degree in a related field, or equivalent experience

Helpful, not required: content, media, or entertainment security experience including TPN; certifications such as CISM, CRISC, CISA, CGEIT, or CISSP.

The annualized salary range for this position in California is $210,000 to $225,000. The base pay offered will factor in internal equity and may also vary depending on the candidate's geographic region, job-related knowledge, skills, and relevant experience, among other factors.

All applicants must be at least 18 years of age at the time of employment. This requirement is in accordance with applicable federal, state, and local labor laws. Cosm is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.