Senior Security Risk Manager - Remote GRC Lead

Smartsheet; United States; Remote; USD 175,000 - 228,000; Full time

Benefits offered by this job

Employer subsidized medical/vision and

Dental coverage for full‑time

401k Match to help you save for your未来

Monthly stipend to support your work

Flexible Time Away Program

US life insurance and disability plans

12 paid holidays per year

Parental Leave (up to 24 weeks)

Volunteer Day

Udemy courses access

Company funded perks and discounts

Teleworking options from any US‑based,

Job summary

Smartsheet is seeking a Sr. Security Engineer I to own the Security Risk Management program end-to-end, including risk identification, analysis, and quantification across internal systems and third parties.

You will oversee the enterprise risk register and drive mitigation strategies while guiding the Third-Party Risk Management program. The role reports to the Senior Director, GRC Engineering and can be based in the Bellevue, WA office or remotely from anywhere in the US where Smartsheet is

Qualifications

• 4+ years in security risk management, enterprise risk, or GRC with direct ownership of a risk register.
• Familiarity with quantification approaches (FAIR/OCTAVE) and practical application.
• Technical fluency to discuss cloud architecture and security with engineers.
• Experience with Third-Party Risk Management including vendor tiering and monitoring.
• Excellent written and verbal communication for leadership briefings.
• Strong organization with multiple concurrent risk items and vendors.
• Professional certifications: CRISC, CISSP, CISM or equivalent.

Responsibilities

• Own and mature the Security Risk Management program end-to-end.
• Maintain the enterprise risk register with ratings, ownership, and mitigations.
• Lead risk analysis for initiatives, architecture changes, and findings.
• Develop and drive risk mitigation plans across engineering, IT, and business units.
• Oversee Third-Party Risk Management: vendor tiering, assessments, and monitoring.
• Build and present risk KPIs to security and business leadership.
• Ensure audits, pen tests, and questionnaires feed back into risk prioritization.

Skills

Risk management

GRC

Vendor risk

Communication

Executive briefing

Organizational skills

Risk analysis

Mitigation planning

Education

CRISC

CISSP

CISM

Tools

Vanta

Drata

OneTrust

Archer

ServiceNow GRC

Job description

Smartsheet is seeking a Sr. Security Engineer I to own the Security Risk Management program end-to-end, including risk identification, analysis, and quantification across internal systems and third parties.

You will oversee the enterprise risk register and drive mitigation strategies while guiding the Third-Party Risk Management program. The role reports to the Senior Director, GRC Engineering and can be based in the Bellevue, WA office or remotely from anywhere in the US where Smartsheet is