Security Risk Manager

ASML•San Jose, CA

5d•Hybrid

About The Position

ASML US is seeking an R&D Security Risk Manager to protect R&D information assets and help ensure information security and export compliance risks remain within the company’s risk appetite. The role is the primary R&D point of contact for Security Risk Management and partners with R&D, IT, Legal, Export Control, Customer Support, and global security teams to support risk-conscious decisions and secure innovation. The position is based on-site in San Jose, California, with a flexible workplace arrangement potentially available for up to two remote-work days per week for employees in suitable roles. Domestic or international travel may be required, up to 10%, depending on business needs.

Requirements

Bachelor’s degree in Information Security, Cybersecurity/Risk, or Audit, or a combination of education and/or equivalent related work experience.
At least 5 years of relevant experience in information security risk management.
Strong background in IT or proven relevant experience in the IT security domain.
Experience with ISO 27001/NIST frameworks, industry standards, and best practices.
Experience working in matrixed, multidisciplinary environments and collaborating with globally distributed teams across multiple regions and time zones.
General understanding of networking, communication protocols, firewalls, operating systems, and foundational information security principles.
Strong communication and interpersonal skills, including the ability to influence, negotiate, and build consensus among diverse stakeholders.
Ability to build effective working relationships across the organization, from engineers and project teams to senior management and business stakeholders.
Strong analytical and problem-solving skills, with attention to detail.
Ability to translate information security threats and vulnerabilities into business risks and actionable recommendations.
Ability to work independently and in a team, demonstrating flexibility, creativity, and commitment in a dynamic organization.
Ability to think strategically and contribute to long-term improvements while delivering pragmatic, fit-for-purpose solutions.
Continuous learning orientation and interest in emerging security threats, industry trends, and evolving technologies.

Nice To Haves

Master’s degree.
Security certifications such as CRISC, CISSP/CISM, or CISA; these are preferred but not required.
Experience working with IT and R&D organizations and understanding of DevOps practices and environments.
Experience with cloud technologies, preferably Microsoft Azure, and cloud security principles.
Experience with AI models, agents, and related security, governance, and technology standards.

Responsibilities

Perform risk-scoping activities (GRC intake) for new business-led projects and initiatives; lead architectural design reviews, recommend mitigating controls, and drive their implementation.
Collaborate with other security disciplines to assess and address risks related to R&D information assets.
Build and maintain a reference network to generate support and engage stakeholders across the R&D organization.
Ensure compliance with security policies and standards, including regulations focused on export-controlled technology.
Conduct information security risk assessments and coordinate penetration testing for existing applications, platforms, and processes; register identified risks, recommend mitigating controls, and drive their implementation.
Contribute to global security initiatives and projects, representing U.S. regional requirements and perspectives to support successful implementation and adoption.
Support the development and delivery of security awareness initiatives to promote secure behaviors and a strong security culture throughout the R&D organization.