Director, Governance, Risk & Compliance

Anomali•Redwood City, CA

4d•Hybrid

About The Position

Anomali is scaling its compliance program to support an AI-native cybersecurity platform used by governments and enterprises worldwide. We're looking for a hands-on GRC leader who can own and drive our multi-jurisdiction certification portfolio — spanning U.S. federal (FedRAMP), global (ISO 27001, SOC 2), and regional cloud security frameworks (UAE DESC, Saudi Arabia NCA/CCC, Australia IRAP) — while building the scalable compliance infrastructure to support continued international expansion. This is a builder role, not a maintainer role. You'll be the single point of accountability for keeping our certifications current, audit-ready, and strategically sequenced to unlock new markets and revenue.

Requirements

8+ years in GRC, information security compliance, or related audit/assurance roles, with 3+ years in a leadership capacity
Direct, hands-on experience with FedRAMP (Moderate or High) as a CSP-side practitioner — not just advisory
Demonstrated ownership of ISO 27001 certification and ongoing ISMS management
Demonstrated ownership of SOC 2 Type II audits, from readiness through report delivery
Experience with at least one Middle East cloud security framework (DESC, Saudi NCA/CCC, or equivalent)
Familiarity with Australia IRAP assessment process
Strong working knowledge of cloud security architecture (AWS/Azure/GCP) and how controls map to technical implementation
Excellent stakeholder management — comfortable working directly with C-suite, auditors, and government sponsors
Exceptional written communication skills (SSPs, policies, board-level reporting)
For candidates residing within commutable distance of Redwood City, CA, this position will be hybrid. Remote candidates based in the US, will also be considered.
This position is not eligible for employment visa sponsorship. The successful candidate must not now, or in the future, require visa sponsorship to work in the US.

Nice To Haves

Certifications: CISSP, CISA, CISM, or ISO 27001 Lead Auditor/Implementer
Experience in a high-growth, venture-backed SaaS or cybersecurity company
Prior experience managing multiple concurrent certifications across regions
Experience with GRC tooling (Vanta, Drata, ServiceNow GRC, or similar)

Responsibilities

Own the end-to-end GRC roadmap across FedRAMP, ISO 27001, SOC 2, DESC (Dubai Electronic Security Center), Saudi NCA Cloud Cybersecurity Controls (CCC), Australia IRAP, and other regional cloud security/data residency frameworks as they arise
Prioritize and sequence certification efforts against GTM and revenue targets, in partnership with sales, product, and executive leadership
Serve as the primary liaison with assessors, auditors, and regulatory bodies (3PAOs, sponsoring agencies, in-country assessors)
Manage ongoing FedRAMP authorization activities (ATO maintenance, continuous monitoring, SAR/POA&M remediation) in partnership with the 3PAO and sponsoring agency
Own documentation quality (SSP, SAR, POA&M) and escalation management when assessor deliverables fall short
Maintain and evolve the ISMS, manage internal/external audit cycles, and drive continuous improvement of controls, risk assessments, and policy frameworks
Own SOC 2 Type II audit readiness and execution (Security, Availability, and Confidentiality trust services criteria) in partnership with the external audit firm
Manage evidence collection, control testing, and remediation of exceptions across annual audit cycles
Ensure alignment between SOC 2 controls and overlapping ISO 27001/FedRAMP requirements to avoid duplicated audit effort
Drive DESC CSP certification for UAE market access. The CSP Security Standard is based on the following international standards, which the candidate should be conversant in: ISO/IEC 27001:2013 ISO/IEC 27002:2013 ISO/IEC 27017:2015 ISR:2017 v.02 CSA Cloud Controls Matrix 3.0.1
Manage Saudi NCA compliance (ECC/CCC) in coordination with local partners
Own Australia IRAP assessment process and coordination with registered assessors
Monitor emerging regional requirements (e.g., additional Gulf, APAC, or EU frameworks) and advise on prioritization
Build and maintain a unified controls framework that maps overlapping requirements across all frameworks to avoid duplicated effort
Own enterprise risk register, vendor/third-party risk management, and remediation tracking
Partner with engineering and product teams to ensure security controls are designed in, not bolted on
Partner with internal cross-functional teams — IT, Security, Cloud Infrastructure, Engineering, and Product — to own and drive compliance outcomes end-to-end
Support customer/prospect due diligence (security questionnaires, audit requests, trust portal)
Partner with legal on regulatory obligations, data residency, and contractual compliance commitments
Report compliance posture and risk to executive leadership and board as needed