Senior Security Risk Engineer

Responsibilities

• Own risk identification, analysis, and prioritization across third-party risk (TPRM), security risk assessments, and security findings, using an established risk framework (e.g., NIST RMF, ISO 31000, or NIST 800-39).
• Translate technical vulnerabilities, control gaps, and risk findings into clear, quantified risk statements that non-security stakeholders and leadership can act on.
• Drive remediation of findings and risk exceptions to closure, partnering with Engineering, IT, Product, and Legal, and escalating stalled or high-severity items.
• Mature and maintain a risk register and quarterly reporting cadence that gives leadership clear visibility into open risk, remediation progress, and trends.
• Own and mature AI risk management, including AI impact assessments, AI risk assessments, and risk treatments, to support ISO 42001 certification.
• Design, develop, and implement key risk indicators and supporting metrics for top risks in the risk register.
• Identify manual, repetitive steps in risk and TPRM workflows and personally build the automation, scripting, or AI-enabled tooling to remove them.
• Contribute to the roadmap for the risk program, incorporating new frameworks, regulatory changes, and lessons learned from past assessments.
• Monitor the internal and external risk landscape (new frameworks, threat trends, business changes) to identify and escalate emerging risks before they become findings.

Languages