Director of Cyber Risk Management, Business Resilience, and Security Culture

Rubrik; United States; Remote; USD 218,000 - 340,000; Full time

Job summary

A leading company is searching for a Director of Cyber Risk Management to enhance their cyber resilience and foster a proactive security culture. This strategic role involves leading efforts in risk management, business continuity, and security awareness to ensure safe operations amidst growing cyber threats. Candidates should exhibit strong leadership, deep expertise in cybersecurity methodologies, and a commitment to cultivating a secure environment.

Qualifications

• 15+ years of experience in information security, preferably within a SaaS organization.
• At least 8 years in a leadership role focused on cyber risk management and business continuity.
• Demonstrated expertise in risk assessment methodologies (e.g., NIST, ISO).

Responsibilities

• Lead the cyber risk management program and ensure alignment with industry best practices.
• Oversee business continuity and disaster recovery programs.
• Drive initiatives to develop a strong security culture across the organization.

Skills

Leadership

Cyber Risk Assessment

Business Continuity

Security Awareness

Analytical Skills

Education

Bachelor's degree in Computer Science

Master's degree in a relevant field

Tools

Risk Quantification Tools

Jira

Confluence

Job description

Rubrik is seeking a highly experienced and strategic Director of Cyber Risk Management, Business Resilience, and Security Culture to lead our efforts in identifying, assessing, mitigating, and monitoring cyber risks across the organization. This role is pivotal in ensuring the continuity of business operations in the face of cyber threats and fostering a strong, proactive security-aware culture. In partnership with the Sr. Director of GRC, the Director will be responsible for developing and implementing comprehensive strategies for cyber risk management, enhancing business resiliency capabilities, and driving security awareness and education programs. This role requires a strong leader with deep technical expertise, excellent communication skills, and a proven track record in influencing risk owners to drive accountability in reducing Rubrik’s risk profile and ensuring the appropriate security posture. In addition, a strong team exists to support the Director in these areas. Therefore, maintaining Rubrik’s culture and retaining talent is a primary responsibility for this role.

Key Responsibilities

Cyber Risk Management:

• Lead and oversee the continuous evolution and operationalization of the cyber risk management program and operating the Risk Management Lifecycle, ensuring alignment with industry best practices (e.g., NIST, ISO 27001).
• Influence business/risk owners to drive risk accountability and proactive reduction of cyber risks and ensure the security posture aligns with business objectives and risk appetite.
• Strategize and prioritize regular cyber risk assessments, identifying vulnerabilities, threats, and potential impacts to critical assets and business processes.
• Lead the cyber risk team and third party security team in delivering the outcomes associated with the Risk Management Lifecycle, providing oversight of Rubrik’s risk register and findings boards, prioritizing and tracking the remediation of identified risks, working closely with IT, engineering, and business units.
• Leverage existing tools for risk quantification to help risk and business owners understand the overall Return on Investment (ROI) associated with risk mitigating initiatives and their impact on the security posture in terms of investment and return.
• Provide comprehensive cyber risk reporting, including monthly operational reports, monthly executive summaries, and quarterly board-level presentations.

Business Resiliency (Disaster Recovery & Business Continuity):

• Provide strategic oversight and direction for Rubrik's business continuity and disaster recovery programs, ensuring alignment with overall business objectives and risk appetite.
• Develop and evolve the long-term strategy for enhancing organizational resilience against various disruptions, including cyberattacks, natural disasters, and operational failures.
• Guide and support strong leaders reporting into this role in the execution of business continuity and disaster recovery plans, including regular testing, simulation exercises, and post-incident reviews.
• Establish and monitor key metrics for business resiliency, ensuring continuous improvement and adherence to established recovery time objectives (RTOs) and recovery point objectives (RPOs).
• Collaborate with key stakeholders to integrate resiliency considerations into strategic planning and major initiatives.

Security Culture & Awareness:

• Define and drive the strategic vision for a pervasive and proactive security culture across the entire organization, ensuring it is embedded in all aspects of business operations.
• Guide and empower the strong program manager reporting into this role to design and implement innovative awareness campaigns, educational content, and communication strategies that foster individual accountability and promote secure behaviors.
• Establish metrics and reporting mechanisms to assess the impact and effectiveness of security culture initiatives, continuously refining the approach based on organizational needs and evolving threat landscapes.
• Champion security as a shared responsibility, working with senior management to ensure adequate resources and support for cultural transformation efforts.

Governance & Compliance:

• Strategically contribute to the governance and compliance programs and collaborate with leaders of those programs to ensure gaps in control efficacy and policy exceptions flow into the Risk Management Lifecycle.
• Support internal and external audits related to cyber risk, business resilience and security culture.

Stakeholder Engagement:

• Collaborate cross-functionally with Security Operations and other security champions to identify and record findings to trigger the Risk Management Lifecycle.
• Collaborate and partner with IT, Legal, Procurement, HR, Audit and various business units to integrate security and resiliency into business processes.
• Communicate complex cyber risk and resiliency concepts to technical and non-technical audiences, including executive leadership.
• Provide strategic direction and oversight of relationships with external vendors and partners related to cyber risk, resiliency, and security awareness.

Qualifications

• 15+ years of progressive experience in information security, preferably inhouse within a SaaS organization, with at least 8 years in a leadership role focused on cyber risk management, business continuity, and security awareness.
• Demonstrated expertise in cyber risk assessment methodologies and frameworks (e.g., NIST RMF, ISO 27005).
• Strong understanding of business continuity and disaster recovery planning principles and practices (e.g., ISO 22301, BCI Good Practice Guidelines).Proven experience in developing and delivering effective security awareness and training programs.
• Excellent written and verbal communication skills, with the ability to articulate complex security concepts to diverse audiences.
• Strong analytical and problem-solving abilities.
• Ability to work independently and collaboratively in a fast-paced environment.
• Proven track record in hiring highly talented individuals and ability to retain talent
• Emotional intelligence necessary to lead a high performing team and maintain Rubrik’s culture and values (Resilience, Integrity, Velocity, Excellence & Transparency

Preferred Qualifications

• Bachelor's degree in Computer Science, Information Security, Business Administration, or a related field.
• Master's degree in a relevant field.
• Relevant industry certifications such as CISSP, CISM, CRISC, CBCP, or equivalent.
• Experience in a highly regulated industry but understanding of risk associated with a SaaS organization delivering for customers that are in a highly regulated environment.
• Familiarity with Jira, Confluence and risk quantification tools
• Experience with cloud security risks and controls (AWS, Azure, GCP).
• Unique ability to roll up sleeves and get involved in the tactics while also developing strategy, building, and leading a team

Rubrik provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Rubrik complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

#LI-KY1

The minimum and maximum base salaries for this role are posted below; additionally, the role is eligible for bonus potential, equity and benefits. The range displayed reflects the minimum and maximum target for new hire salaries for the role based on U.S. location. Within the range, the salary offered will be determined by work location and additional factors, including job-related skills, experience, and relevant education or training. US (SF Bay Area, DC Metro, NYC) Pay Range $242,500 — $339,700 USD The minimum and maximum base salaries for this role are posted below; additionally, the role is eligible for bonus potential, equity and benefits. The range displayed reflects the minimum and maximum target for new hire salaries for the role based on U.S. location. Within the range, the salary offered will be determined by work location and additional factors, including job-related skills, experience, and relevant education or training. US2 (all other US offices/remote) Pay Range $218,200 — $305,800 USD Join Us in Securing the World's Data

Rubrik (NYSE: RBRK) is on a mission to secure the world’s data. With Zero Trust Data Security, we help organizations achieve business resilience against cyberattacks, malicious insiders, and operational disruptions. Rubrik Security Cloud, powered by machine learning, secures data across enterprise, cloud, and SaaS applications. We help organizations uphold data integrity, deliver data availability that withstands adverse conditions, continuously monitor data risks and threats, and restore businesses with their data when infrastructure is attacked.

Linkedin | X (formerly Twitter) | Instagram |Rubrik.com

Inclusion @ Rubrik

At Rubrik, we are dedicated to fostering a culture where people from all backgrounds are valued, feel they belong, and believe they can succeed. Our commitment to inclusion is at the heart of our mission to secure the world’s data.

Our goal is to hire and promote the best talent, regardless of background. We continually review our hiring practices to ensure fairness and strive to create an environment where every employee has equal access to opportunities for growth and excellence. We believe in empowering everyone to bring their authentic selves to work and achieve their fullest potential.

Our inclusion strategy focuses on three core areas of our business and culture:

• Our Company: We are committed to building a merit-based organization that offers equal access to growth and success for all employees globally. Your potential is limitless here.

• Our Culture: We strive to create an inclusive atmosphere where individuals from all backgrounds feel a strong sense of belonging, can thrive, and do their best work. Your contributions help us innovate and break boundaries.

• Our Communities: We are dedicated to expanding our engagement with the communities we operate in, creating opportunities for underrepresented talent and driving greater innovation for our clients. Your impact extends beyond Rubrik, contributing to safer and stronger communities.

Equal Opportunity Employer/Veterans/Disabled

Rubrik is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability.

Rubrik provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Rubrik complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

Federal law requires employers to provide reasonable accommodation to qualified individuals with disabilities. Please contact us at [e-mail] if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.

EEO IS THE LAW

NOTIFICATION OF EMPLOYEE RIGHTS UNDER FEDERAL LABOR LAWS