Security Governance Lead - Enterprise Risk & AI

Envestnet; Chesterbrook (PA); Hybrid; USD 139,000 - 173,000; Full time

Job summary

Envestnet seeks an experienced cybersecurity risk professional to join the Enterprise Cybersecurity team. The role involves aligning technology decisions with business strategy, regulatory requirements, and client expectations, while managing a comprehensive risk framework across applications, cloud platforms, and third‑party integrations.

You will lead risk assessments, develop governance policies, and partner with Legal, Compliance, and AI/ML engineering to implement effective controls.

Qualifications

• Hands‑on experience evaluating and defining security controls for AI agents, models, and applications.
• Familiarity with risk and governance frameworks (e.g., NIST AI RMF, ISO/IEC 42001).
• Hands‑on experience performing Security Risk Assessments and documenting risk scenarios, impacts, controls, and conclusions.
• Strong understanding of security control frameworks (NIST CSF, NIST SP 800‑53) and risk methodologies.
• Demonstrated experience evaluating control effectiveness and supporting remediation planning.
• Familiarity with continuous monitoring concepts and tools (e.g., vulnerability management, CSPM, configuration monitoring).
• Ability to clearly document and communicate security risk to both technical teams and non‑technical stakeholders.

Responsibilities

• Provide Security Governance support and guidance across the organization.
• Develop, validate, implement and maintain cybersecurity policies, standards, and procedures to ensure regulatory compliance.
• Collaborate with cross‑functional teams to ensure security controls are documented and managed.
• Coordinate with Legal and compliance functions on data privacy requirements and disclosures.
• Establish and maintain the Security Governance documentation framework and roadmap.
• Define risk tolerance and construct risk scenarios with Cyber Security and business partners.
• Ensure risk scenarios reflect business context and threats for informed decisions.
• Perform Security Risk Assessments across applications, cloud, and third‑party integrations.
• Assess design and effectiveness of security controls with engineering teams to mitigate risk.
• Operate continuous risk monitoring tools to detect changes in risk posture and remediation needs.
• Own risk lifecycle—documentation, remediation, validation, and reporting.

Skills

Security Governance

Risk Assessments

Regulatory Requirements

Data Privacy

NIST CSF

ISO/IEC 42001

Tools

Jira workflows

GRC platforms

Job description

Envestnet seeks an experienced cybersecurity risk professional to join the Enterprise Cybersecurity team. The role involves aligning technology decisions with business strategy, regulatory requirements, and client expectations, while managing a comprehensive risk framework across applications, cloud platforms, and third‑party integrations.

You will lead risk assessments, develop governance policies, and partner with Legal, Compliance, and AI/ML engineering to implement effective controls.