Manager, CyberSecurity Risk Management

rubrik; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

Rubrik is seeking a Senior Cybersecurity Risk Manager to lead the day-to-day operation and continued development of a risk program. You will coordinate assessments, remediation, governance, and reporting across technical and business teams, translating findings into business priorities.

You will maintain the risk register, track remediation, prepare risk committee materials, and build dashboards to quantify risk, shaping improvements to GRC tooling and assessment processes for scale.

Qualifications

• At least eight years of cybersecurity risk management or GRC experience, including three or more years in program or project management.
• Experience supporting or scaling a cybersecurity risk program in a technology, SaaS, or cloud environment.
• Ability to assess technical and organizational risks, validate controls and explain findings in terms of business impact.
• Strong program coordination skills across stakeholders, timelines, dependencies, and remediation work.
• Clear written and verbal communication, including leadership reporting and facilitation of governance discussions.
• Familiarity with security and compliance frameworks such as ISO 27001, SOC 2, FedRAMP, NIST, PCI DSS, or HIPAA.

Responsibilities

• Coordinate and conduct risk assessments for products, infrastructure, applications, cloud services, initiatives, and third-party suppliers.
• Triage security issues and document risk statements, including business impact, likelihood, assumptions, and treatment options.
• Maintain the risk register with accurate owners, decisions, statuses, milestones, and target dates.
• Track remediation across teams, follow up with risk owners, resolve or elevate blockers, and report progress through closure.
• Prepare risk committee materials and coordinate acceptance, exception, and escalation reviews, tracking decisions and actions.
• Analyze program metrics, build dashboards, support risk quantification, and help improve assessment processes and GRC tooling.

Skills

Risk management

Program management

Stakeholder coordination

Security governance

Business impact analysis

Leadership reporting

ISO 27001

SOC 2

Tools

GRC tooling

Dashboards

Risk tools

Job description

Role overview

Support the day-to-day operation and continued development of a cybersecurity risk management program. The role coordinates assessments, remediation, governance, and reporting across technical and business teams, translating security findings into clear priorities and giving leadership a useful view of risk exposure and progress.

Responsibilities

• Coordinate and conduct risk assessments for products, infrastructure, applications, cloud services, initiatives, and third-party suppliers.
• Triage security issues and document risk statements, including business impact, likelihood, assumptions, and treatment options.
• Maintain the risk register with accurate owners, decisions, statuses, milestones, and target dates.
• Track remediation across teams, follow up with risk owners, resolve or elevate blockers, and report progress through closure.
• Prepare risk committee materials and coordinate acceptance, exception, and escalation reviews, tracking decisions and actions.
• Analyze program metrics, build dashboards, support risk quantification, and help improve assessment processes and GRC tooling.

Requirements

• At least eight years of cybersecurity risk management or GRC experience, including three or more years in program or project management.
• Experience supporting or scaling a cybersecurity risk program in a technology, SaaS, or cloud environment.
• Ability to assess technical and organizational risks, validate controls and explain findings in terms of business impact.
• Strong program coordination skills across stakeholders, timelines, dependencies, and remediation work.
• Clear written and verbal communication, including leadership reporting and facilitation of governance discussions.
• Familiarity with security and compliance frameworks such as ISO 27001, SOC 2, FedRAMP, NIST, PCI DSS, or HIPAA.

Nice to have

• Experience with emerging regulatory requirements, risk quantification, or supplier risk programs.
• Exposure to GRC automation or AI-assisted workflows, with attention to governance and human review.