Security Governance & Compliance Manager

The role provides risk owners and senior leadership with what they need to make informed risk decisions. It takes the lead on the most complex, ambiguous, or high-visibility risk work in the program. It owns technical security risk assessments end-to-end, drives remediation and residual-risk decisions, and represents the risk program in executive and audit forums. The person works with significant independence, mentors other analysts, and represents Risk Management where technical leaders and executives make real decisions.

Responsibilities

• Independently lead complex, ambiguous, or cross-functional technical risk assessments with minimal oversight, using AI-assisted assessment tools where applicable.
• Serve as a trusted advisor to senior technical leaders and executives on risk posture, prioritization, and tradeoffs.
• Develop and deliver executive-level risk reporting, metrics, and trend analysis, translating technical risk into business impact for CISO and leadership audiences, including board-level support.
• Own escalation and negotiation on high-risk exception requests and complex remediation disputes, assessing residual risk and compensating controls independently.
• Monitor the risk portfolio at program level, identify systemic gaps or patterns across the register, and drive process, tooling, or automation improvements.
• Maintain and improve risk register data quality (ownership, treatment plans, due dates, closure criteria), setting the standard for other analysts.
• Lead support for internal and external audits, including owning evidence packages, documentation, and process walkthroughs.
• Build strong relationships with engineering leaders and business unit executives.
• Lead difficult, high-stakes conversations with technical and executive stakeholders.
• Mentor and guide junior and mid-level risk analysts.

Minimun Qualifications:

• Bachelor's degree or equivalent work experience.
• Professional certification such as GIAC, CISSP, CRISC, CISM, CISA, ISO 27001 LI/LA, CCSK, or CCSP.
• 7-10+ years of hands-on technical risk assessments in a security risk management role, including independently owning complex or ambiguous assessments end-to-end.
• Deep cloud technical knowledge (AWS, Azure, GCP): able to independently evaluate an architecture, find non-obvious control gaps, and advise engineering leaders on remediation, not just flag the gap.
• Extensive hands-on experience leading assessments and audits against frameworks (NIST CSF/RMF, ISO 27001/27002, ISO 42001, NIST AI RMF), including shaping how frameworks are applied.

Preferred Qualifications:

• Splunk products, SPL, and building dashboards and reports.
• Python or SQL for risk metrics and program-level automation.
• Mentoring analysts or informally leading a workstream or team.
• Preparing materials for, or presenting in, board-level or executive governance forums.
• Thriving in ambiguity, including defining new processes where none exist.

At Cisco, we’re revolutionizing how data and infrastructure connect and protect organizations in the AI era – and beyond. We’ve been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint.

Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you’ll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere. 

We are Cisco, and our power starts with you.