Manager, CyberSecurity Risk Management

Rubrik Job Board

2d•$163,400 - $272,400

About The Position

Rubrik’s Information Security organization develops security technologies, tools, and processes; coordinates major security initiatives; monitors and responds to attacks; promotes data-protection best practices; and supports data governance and secure third-party relationships. The Manager, CyberSecurity Risk Management joins the security risk management team to support delivery of Rubrik’s cybersecurity risk management program. Working with the lead Program Manager who owns the program, this role drives day-to-day execution, including cross-functional risk assessments, risk review and acceptance, remediation tracking, and leadership reporting. The role partners with Security, Engineering, Product, IT, Legal, Procurement, and Finance to keep initiatives moving and deliver measurable outcomes. The position supports program operations and governance, executes and documents cybersecurity risk assessments, maintains the risk register, coordinates remediation, and develops metrics and dashboards. It also supports enterprise, technical, and supplier assessments; maps activities to applicable frameworks and regulations; contributes to risk quantification and process improvements; and helps implement GRC tooling, automation, and AI-enabled workflows with appropriate governance and human review. Success requires program management discipline, risk and compliance knowledge, technical fluency, and the ability to influence stakeholders and build consensus without direct authority.

Requirements

At least 8 years of experience in cybersecurity risk management or GRC, including at least 3 years in a program or project management role.
Experience supporting or helping scale a cybersecurity risk management program in a fast-paced technology, SaaS, or cloud company.
Strong program management skills, including project planning, dependency management, effort estimation, status reporting, and delivery of cross-functional initiatives.
Working knowledge of risk management methodologies including NIST RMF, NIST 800-37, NIST 800-30, ISO 27005, and COBIT.
Knowledge of security frameworks including ISO 27001/2, SOC 2, FedRAMP, NIST CSF/800-53, CIS Controls, PCI DSS, and HIPAA.
Technical understanding of cloud, identity, network, and application security sufficient to engage with engineering teams and follow remediation plans.
Ability to communicate risk clearly to senior stakeholders and build consensus without direct authority.
Hands-on experience with agile project management and reporting tools such as Jira, Confluence, and Tableau.
Excellent written and verbal communication, organization, and stakeholder management skills.
Bachelor’s degree in Security, Computer Science, Management Information Systems, or a related field, or equivalent practical experience.

Responsibilities

Support program operations for the overall Cybersecurity Risk Management Program.
Support and conduct risk assessments and triage incoming security issues related to Rubrik’s core products, services, and infrastructure.
Draft risk statements that translate technical findings into business impact, including likelihood and impact rationale and key assumptions.
Maintain and update the risk register, ensuring ownership, status, target dates, and risk treatment decisions are accurate and timely.
Coordinate and track cross-functional risk initiatives, managing timelines, dependencies, and action items; flag delivery risks early and drive follow-through.
Drive risk remediation to closure through periodic check-ins with risk owners, progress and milestone tracking, risk-register updates, blocker removal or escalation, and leadership status reporting.
Support risk governance, including preparing risk committee materials, facilitating risk acceptance and exception reviews, and tracking escalations, decisions, and actions to completion.
Collect and analyze program KPIs and KRIs, build dashboards, and help prepare leadership risk updates.
Support enterprise, technical, and third-party or supplier risk assessments, helping maintain consistent methodology, quality, and turnaround times.
Execute and document inherent and residual cybersecurity risk assessments for systems, applications, cloud services, and initiatives; gather evidence and validate control implementation with stakeholders.
Help map program activities to compliance obligations, security frameworks, and emerging regulations.
Contribute to risk quantification so risks can be prioritized in business and financial terms.
Support GRC tooling, automation, and AI-enabled improvement initiatives by gathering requirements, coordinating implementation, piloting use cases, and driving adoption of standardized workflows with appropriate governance and human review.
Identify gaps and recommend process improvements to make risk management more efficient, consistent, and effective.