Manager, IT Risk Operations

Accountabilities:

• • IT governance and risk management: Lead executive reporting on IT risk, compliance posture, operational performance, and control effectiveness, while maintaining and evolving the IT risk register and Risk & Control Self-Assessment program.
  • Risk analytics and reporting: Develop KPI and KRI dashboards that provide visibility into emerging risk trends, control performance, and operational issues, translating complex technology and security data into clear recommendations for senior leadership.
  • Controls and compliance: Ensure adherence to IT policies, standards, and leading frameworks such as NIST and ISO/IEC 27001, while identifying systemic and emerging risks across technology, security, privacy, and operational processes.
  • Incident governance and investigations: Partner with Legal, Security, and IT stakeholders to support and lead internal investigations and ensure appropriate governance and follow-through.
  • ITSM governance: Oversee governance and reporting across the IT Service Management ecosystem, analyzing incident, change, and problem-management data to identify trends, control gaps, and opportunities for operational improvement.
  • ServiceNow optimization: Drive workflow optimization, reporting enhancements, and automation within ServiceNow to improve IT service visibility and operational efficiency.
  • Vendor risk management: Review and advise on vendor agreements while strengthening risk tiering, assessment, monitoring, reporting, and governance processes.
  • Process improvement: Identify opportunities to streamline risk and compliance processes, enhance reporting, improve controls, and introduce data-driven approaches to technology risk management.
  • Team leadership: Manage and support a small team while fostering accountability, collaboration, analytical rigor, and continuous improvement.
  • Stakeholder partnership: Work closely with senior IT, Security Engineering, Legal, and organizational leadership to establish a consistent, practical, and measurable approach to technology risk.

  Requirements:

  • Education: Bachelor’s degree preferred.
  • Experience: Approximately 7+ years of experience in IT risk, security compliance, technology audit, IT governance, or a related discipline.
  • Regulated environments: Experience working in complex or regulated organizations, such as legal services, financial services, consulting, or similarly sophisticated environments, is preferred.
  • Risk and controls expertise: Strong understanding of control design, risk registers, RCSA programs, audit response, and technology governance.
  • Framework knowledge: Working knowledge of NIST Cybersecurity Framework, ISO/IEC 27001, and SOC 2.
  • ITSM expertise: Familiarity with ServiceNow and ITSM reporting, including incident, change, and problem-management lifecycles.
  • Technology knowledge: Experience with Microsoft 365, Purview, email security technologies, and related security and collaboration platforms.
  • Analytics: Proven ability to lead reporting, analytics, governance initiatives, and data-driven risk programs.
  • Privacy: Basic understanding of applicable privacy regulations and their implications for technology and operational risk.
  • Leadership and communication: Ability to manage a team, influence senior stakeholders, communicate complex risk topics clearly, and translate data into practical business recommendations.
  • Certifications: CISA, CISSP, CRISC, CTPRM, and/or ITIL certifications are preferred.
  • Work arrangement: The role may be performed 100% remotely or through a hybrid arrangement for candidates located near one of the organization's physical offices.

  Benefits:

  • Competitive annual salary:
    • Palo Alto, New York, and San Francisco: $163,200–$220,800.
    • Austin, Boston, Boulder, Century City, Los Angeles, Salt Lake City, San Diego, and Seattle: $147,050–$198,950.
    • Compensation may vary based on qualifications, experience, education, certifications, and work location.
    • Potential discretionary year-end merit bonus based on performance.
    • Competitive overall benefits package.
    • Professional and personal development opportunities.
    • Flexible remote or hybrid work environment.
    • Work-life balance supported through a team-oriented and collaborative culture.
    • Opportunities to contribute to a sophisticated technology, security, and risk environment spanning multiple business and geographic locations.