Manager- Security Risk Management

Costco IT•Issaquah, WA

27d•$137,000 - $210,000

About The Position

Costco IT is seeking a Manager of Security Risk Management to lead the security risk and compliance team. The position sets and implements the organization’s risk management strategy, oversees identification and assessment of security risks, leads the design and implementation of automated risk and control assessment processes, and manages a centralized risk register and reporting to support decision-making. The manager will build and lead a small, highly skilled team, developing its strategic vision and plan in alignment with company and IT Division goals. The role works closely with security teams, privacy experts, legal, and IT and business leaders to provide actionable insights and encourage risk-based decisions across the organization. It also includes defining measures of team success and periodically reporting program results and impact to leadership. As a member of the IT Management Team, the manager oversees team performance and deliverables, develops employees, and models Costco’s culture and guiding principles. The role emphasizes open communication, employee engagement, trust, inclusion, integrity, member service, sound judgment, confidentiality, and adherence to information security policy. This is a full-time management/leadership position requiring 45 or more hours per week and regular, reliable attendance at the assigned workplace.

Requirements

At least 8 years of experience in security or compliance risk management, technology audit, or related fields.
Strong understanding of information security and security governance, risk, and compliance frameworks, methodologies, and practices.
Technical security and architecture knowledge, including the ability to recognize, analyze, and troubleshoot issues and explain them to technical and non-technical audiences.
Strong leadership and team management skills, with demonstrated ability to lead cross-functional teams and drive organizational change.
Excellent communication and relationship skills, including the ability to explain advanced technical topics to non-technical audiences and build consensus among partners and leadership.
Ability to serve as a subject matter expert in enterprise security risk assessments, risk response, and risk management programs.
Knowledge of regulatory and compliance requirements affecting security and ability to collaborate on risk-appropriate solutions and support audit activities.
Ability to operate vehicles, equipment, or machinery.
Regular and reliable attendance at the assigned workplace.
HIPAA Training and Supervisors Orientation within 30 days of hire; Leadership Development 101 within one year; Costco Pay Policies within 90 days of promotion.
Required application documents: cover letter and resume.

Nice To Haves

At least 3 years of experience leading security, compliance, or risk teams in a management or supervisory role (listed as preferred).
Bachelor’s degree in Information Technology, Artificial Intelligence, Cybersecurity, Risk Management, or a related field.
Relevant certifications such as CISSP, CISM, or CRISC.
Proficiency in Google Workspace applications, including Sheets, Docs, Slides, and Gmail.

Responsibilities

Build and lead a high-performing team of security risk professionals; coach employees and provide career development opportunities while fostering collaboration and innovation.
Develop, implement, and maintain a comprehensive security risk management strategy and its ongoing operations to identify, assess, and prioritize organizational security risks.
Lead the identification and implementation of solutions to automate risk and control assessments.
Develop and maintain a centralized security risk register and reporting mechanisms to support transparency and accountability.
Collaborate with other departments to communicate risk trends and mitigation strategies.
Define KPIs and measures of team success, and provide leadership with periodic reporting on results and impact.
Serve as a subject matter expert for enterprise security risk assessments, risk response, and risk management programs.
Aggregate and analyze risk signals from vulnerability management, threat intelligence, cloud security, third-party risks, and other security domains to inform risk decisions and priorities.
Research and monitor emerging risks associated with technologies such as artificial intelligence, implementations, and configurations, applying industry best practices to reduce organizational exposure.
Understand regulatory and compliance requirements affecting security and collaborate with business and project teams on risk-appropriate solutions, including supporting audit activities.
Present risk posture, technical findings, and recommendations to executives, management, and cross-functional audiences to build consensus and drive decisions.
Use AI-powered tools to enhance risk identification, prioritization, and reporting workflows, and identify opportunities to responsibly automate risk processes.
Automate, document, educate, and delegate risk processes to improve team efficiency and scalability.
Manage team performance and deliverables; coach and mentor employees, discuss performance and career development, and identify learning opportunities.
Communicate regularly with employees, handle employee concerns appropriately, and follow them through to resolution.
Ensure appropriate department coverage, understand the department budget, and research and explain budget variances.
Provide and ensure staff provide an exceptional member experience.
Maintain confidentiality of employee and member information and adhere to information security policy.
Promote integrity, inclusion, open communication, and sound judgment; address issues promptly and navigate difficult conversations effectively.
Complete HIPAA Training and Supervisors Orientation within 30 days of hire, Leadership Development 101 within one year, and Costco Pay Policies within 90 days of promotion.