Manager, Security Governance, Risk, and Compliance (Cybersecurity)

Location: Mountain View, USA

Base pay: $164,000–$282,000 per year, depending on geographic market, knowledge, skills, and experience.

Company

A global public commerce company building shopping, eating, and living services in the South Korean commerce market.

What you will do

• Drive scalable methodologies for identifying, assessing, prioritizing, monitoring, and escalating cybersecurity risks across high-scale technology environments.
• Partner with AI GRC to maintain a unified cybersecurity and AI risk taxonomy and governance framework aligned with NIST CSF, NIST AI RMF, ISO 27001, ISO 42001, and regional regulatory obligations.
• Maintain an enterprise risk register connecting inherent risks, control gaps, treatment plans, and residual exposure through automated data feeds.
• Establish key risk indicators and executive reporting that translate technical findings, assurance results, and emerging threats into actionable business risk insights.
• Develop cybersecurity control governance, including control objectives, ownership expectations, effectiveness criteria, framework harmonization, traceability, and continuous monitoring priorities.
• Lead, mentor, and scale the Security GRC team while partnering with risk owners and engineering, product, and leadership stakeholders on remediation, risk acceptance, and accountability.

Requirements

• Deep expertise in cybersecurity governance, risk management, and control frameworks, including the ability to translate technical weaknesses into business risk.
• Experience establishing risk assessment methodologies, risk registers, risk treatment workflows, executive reporting, and continuous, evidence-based risk oversight.
• Strong understanding of control design, effectiveness testing, control performance, and residual risk.
• Excellent communication and stakeholder management skills, including constructive challenge of risk decisions and influence with senior leaders.
• Experience leading cross-functional initiatives and mentoring governance, risk, or security professionals.
• 6+ years of progressive experience in cybersecurity governance, risk management, security engineering, or a related field.
• Experience building or maturing cybersecurity risk management capabilities in complex, high-scale technology environments.
• Experience leading teams, strategic initiatives, and cross-functional programs.
• Bachelor’s degree in a related field or equivalent professional experience.
• Working knowledge of NIST CSF, NIST AI RMF, ISO 42001, and ISO 27001.
• Direct experience managing enterprise risk registers, overseeing remediation and treatment lifecycles, and reporting material risk exposure.

Nice to have

• Hands-on security engineering experience and technical understanding of cloud infrastructure, application security, and modern security controls.
• Experience writing Java and Spring Boot applications in AWS and Kubernetes environments.
• Experience in application or product security, including building static and dynamic security testing tools, container scanning pipelines, open-source software vulnerability remediation pipelines, and Kubernetes security.
• Experience leading or mentoring engineers to build a security or infrastructure service from scratch.
• Experience identifying, testing, and remediating vulnerabilities from the OWASP Top 10 and CWE/SANS Top 25, including writing exploits and verification.

Culture & Benefits

• Startup culture combined with the resources of a large global public company.
• Medical, dental, vision, life, AD&D, disability, FSA, HSA, EAP, and 401(k) with company match.
• 18–21 days of paid time off annually based on tenure and 12 paid holidays.
• Paid parental leave and pre-tax commuter benefits.
• Free electric car charging station in Mountain View.
• Annual bonus opportunity of 0–20% of base salary.

Hiring process

• Application review, job fit interview, focus interview, and offer.
• Interview schedules and results are communicated by email; the process may vary based on scheduling and other circumstances.