Senior Director, GRC & Risk Governance

Cosm; Los Angeles (CA); On-site; USD 210,000 - 225,000; Full time

Job summary

Cosm is building its information security program and this role owns the governance backbone. The position focuses on risk management, audits, and vendor security across enterprise environments in a fast‑growing immersive tech company.

Responsibilities include maintaining the risk register, ensuring policy alignment, and coordinating internal audits and external assessments. The role requires deep knowledge of NIST CSF 2.0, ISO 27001, and SOX ITGC.

Qualifications

• 8–12 years in IT governance, risk, and compliance.
• Hands-on experience operating and maturing risk registers, risk assessments, gap analyses, and remediation.
• Experience owning a third-party risk program and vendor security attestations.
• Experience producing board- or audit-committee level reporting on risk posture and remediation.

Responsibilities

• Operate and mature the risk register with ownership and closure tracking.
• Verify that engineering and IT controls are designed correctly and functioning.
• Plan and run internal audits, support external assessments, and due diligence.
• Own the vendor security program end to end from intake to monitoring.
• Author and maintain security policies and map them to frameworks.
• Design and track a metrics framework with KPIs and KRIs tied to risk appetite.
• Provide risk context for incident reviews and post-incident findings.

Skills

GRC leadership

Risk assessment

SOX ITGC

Internal audits

Third-party risk

Education

Bachelor's degree

Tools

Vanta

Job description

Cosm is building its information security program and this role owns the governance backbone. The position focuses on risk management, audits, and vendor security across enterprise environments in a fast‑growing immersive tech company.

Responsibilities include maintaining the risk register, ensuring policy alignment, and coordinating internal audits and external assessments. The role requires deep knowledge of NIST CSF 2.0, ISO 27001, and SOX ITGC.