Security Risk Manager

ASML•San Jose, CA

7d•$141,563 - $207,625•Hybrid

About The Position

The R&D Security Risk Manager serves as the primary R&D point of contact for Security Risk Management, helping protect ASML’s R&D information assets and keep information security and export compliance risks within the company’s risk appetite. The role partners with R&D teams, IT, Legal, Export Control, Customer Support, and global security competence centers to support informed, risk-conscious decision-making and secure innovation. The position is based on-site in San Jose, California, with a flexible arrangement of up to two remote-work days per week potentially available for roles conducive to remote work. Domestic and/or international travel may be required, up to 10%, depending on business needs. The role scopes risks for business-led projects and initiatives, reviews architectural designs, recommends mitigating controls, and drives implementation. It assesses risks to R&D information assets, supports compliance with security policies and export-control requirements, and coordinates penetration testing. The manager also contributes to global security initiatives, represents U.S. regional requirements, and supports security awareness efforts across R&D. The role requires at least five years of relevant information security risk management experience, a strong IT or IT security background, and familiarity with ISO 27001/NIST frameworks, standards, and best practices. A bachelor’s degree in Information Security, Cybersecurity/Risk, Audit, or equivalent education and/or related work experience is required. A master’s degree and certain security certifications are preferred. Candidates must be legally authorized to access controlled technology under U.S. Export Administration Regulations before starting work.

Requirements

Bachelor’s degree in Information Security, Cybersecurity/Risk, Audit, or a combination of education and/or equivalent related work experience.
At least 5 years of relevant experience in information security risk management.
Strong IT background or proven relevant experience in the IT security domain.
Experience with ISO 27001/NIST frameworks, industry standards, and best practices.
Experience collaborating in matrixed, multidisciplinary environments with globally distributed teams across regions and time zones.
General understanding of networking, communication protocols, firewalls, operating systems, and foundational information security principles.
Experience with cloud technologies, preferably Microsoft Azure, and cloud security principles.
Experience with AI models, agents, and related security, governance, and technology standards.
Results-driven ownership and accountability, with the ability to follow through with minimal supervision.
Strong communication and interpersonal skills, including the ability to influence, negotiate, and build consensus among diverse stakeholders.
Ability to build working relationships across the organization, including with engineers, project teams, senior management, and business stakeholders.
Strong analytical and problem-solving skills and high attention to detail.
Ability to translate information security threats and vulnerabilities into meaningful business risks and actionable recommendations.
Ability to work independently and as part of a team, with flexibility and creativity in a dynamic organization.
Strategic thinking and ability to contribute to long-term improvements while delivering pragmatic solutions.
Commitment to continuous learning about emerging security threats, industry trends, and evolving technologies.
Legal authorization to access controlled technology under U.S. Export Administration Regulations before beginning work.

Nice To Haves

Master’s degree.
Preferred security certifications such as CRISC, CISSP, CISM, or CISA; certifications are not required.
Experience working with IT and R&D organizations.
Understanding of DevOps practices and environments.

Responsibilities

Perform risk scoping (GRC intake) for new business-led projects and initiatives.
Lead architectural design reviews, recommend mitigating controls, and drive their implementation.
Collaborate with security disciplines to assess and address risks related to R&D information assets.
Build and maintain a reference network to engage stakeholders and generate support across the R&D organization.
Ensure compliance with security policies and standards, including regulations governing export-controlled technology.
Conduct information security risk assessments and coordinate penetration testing for existing applications, platforms, and processes.
Register identified risks, recommend mitigating controls, and drive their implementation.
Contribute to global security initiatives and projects, representing U.S. regional requirements and perspectives.
Support the development and delivery of security awareness initiatives to promote secure behaviors and a strong security culture in R&D.