Risk Manager

As Risk Manager, you will lead the identification, assessment, treatment, monitoring, and reporting of information security and business risks across Ping Identity. You will help ensure that risk decisions are consistent, evidence-based, clearly communicated, and aligned with the company’s objectives, risk appetite, and customer trust commitments.

You will partner with stakeholders across Enterprise Security, Engineering, Product, Legal, Privacy, People Team, Sales, Customer Success, and Finance to maintain and continuously improve Ping Identity’s risk management practices and supporting governance. Your work will connect enterprise risk management with the Information Security Management System (ISMS), Business Continuity Management System (BCMS), AI Management System (AIMS), control environment, customer assurance capability, and audit readiness.

You will balance strong risk oversight with pragmatic execution, helping the organisation understand its most material risks, make informed trade-offs, and track risk treatment through to measurable resolution. You will also contribute to a scalable operating model through clear governance routines, useful metrics, effective stakeholder engagement, and continuous improvement.

You will:

• Run and continuously improve the information security risk management lifecycle, including risk identification, assessment, prioritisation, treatment, acceptance, monitoring, and reporting.

• Run enterprise, business-unit, project, technology, and third-party risk assessments, ensuring risks are evaluated consistently and documented with clear business context.

• Maintain risk registers, risk statements, treatment plans, action owners, due dates, and escalation paths, ensuring material risks remain visible and actively managed.

• Define and monitor risk appetite, tolerance indicators, key risk indicators, and management reporting that support timely decision-making by security and business leadership.

• Advise senior leaders and control owners on risk acceptance, mitigation options, compensating controls, residual risk, and escalation requirements.

• Partner with control owners and business stakeholders to improve control design, evidence quality, remediation effectiveness, and the connection between controls and material risks.

• Maintain and improve the ISMS, BCMS, and AIMS risk components, including policies, standards, procedures, risk methodologies, control mappings, and governance records.

• Coordinate risk-related inputs to internal and external audits, customer assurance activities, regulatory requests, and security questionnaires.

• Oversee third-party and supplier risk activities, including inherent risk assessments, due diligence, risk treatment, ongoing monitoring, issue management, and exception handling.

• Establish governance routines, workflows, playbooks, service levels, and escalation processes that improve risk visibility, consistency, and operational efficiency.

• Track remediation and risk treatment commitments, challenge weak or overdue actions, and provide clear reporting on trends, dependencies, and residual exposure.

• Use operational data and metrics to identify systemic issues, improve programme performance, and demonstrate the effectiveness of risk management activities.

• Act as an escalation point for complex or ambiguous risk matters and help stakeholders reach practical, defensible, and appropriately documented decisions.

• Contribute to the development of GRC and Information Security team capability through coaching, knowledge sharing, and continuous improvement.

You have:

• Demonstrable experience leading information security risk assessments and treatment programmes in a complex, technology-led organisation.

• Experience with and understanding of recognised compliance frameworks and standards such as ISO 27001, SOC 2, ISO 27017, ISO 27018, NIST, HIPAA, or similar, and their relationship with enterprise risk.

• Strong understanding of security and technology risks across systems, networks, applications, cloud services, identity platforms, and business processes.

• Experience working with cloud environments such as AWS, GCP, or Azure and the ability to translate technical issues into business risk.

• Experience with risk registers, risk acceptance, exception management, remediation tracking, control validation, and residual-risk reporting.

• Experience working with internal and external auditors, control owners, executive stakeholders, and cross-functional delivery teams.

• Experience with third-party or supplier risk management, including due diligence, contractual risk considerations, and ongoing oversight.

• Strong written and verbal communication skills, with the ability to tailor risk narratives for technical teams, auditors, executives, customers, and other stakeholders.

• Strong judgement, prioritisation, analytical thinking, and problem-solving skills, especially in ambiguous or cross-functional situations.

• The ability to challenge constructively, influence without direct authority, and build trust while maintaining appropriate risk discipline.

• Experience using metrics, data, and operational reporting to improve risk visibility and programme effectiveness.

• Experience developing enterprise risk reporting, key risk indicators, risk appetite statements, or risk committee materials.

• Experience leading customer assurance or security questionnaire programmes.

• Experience with GRC, risk, audit, or compliance platforms and workflow automation.

• Experience improving risk assessment, evidence collection, control testing, or reporting through automation.

• Experience working in a SaaS, cloud, identity, or software development environment.

• Relevant certifications such as CISSP, CISM, CISA, CRISC, CGEIT, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor.

• Experience partnering closely with Legal, Sales, Privacy, Engineering, Product, Finance, and Procurement on security and compliance risks.