Lead Security Governance & Risk Engineer

📋 Description

• Own risk programme parts turning policy into measurable risk decisions
• Run technology and third-party risk register and ISO 42001 readiness
• Build automation giving a continuously updated risk posture
• Partner with Engineering, Product, Legal, Audit, ARIA, and Finance on risk clarity
• Operate as second line of defense with independent oversight
• Lead AI risk governance and risk scoring; drive ISO 42001 readiness
• Drive cross-functional risk reporting and governance cadence

🎯 Requirements

• 7+ years in information security or technology risk
• Strong command of cyber risk quantification in financial terms (FAIR)
• Hands-on engineering: SQL, Python, and APIs for data extraction/automation
• Experience building/running tech and/or third-party risk registers
• Knowledge of NIST CSF, RMF, ISO 27000, ISO 42001, SOC 2, PCI DSS, CIS
• Hands-on familiarity with modern risk tooling: TPRM, cyber risk quantification, vulnerability mgmt
• Ability to translate risk into business impact and enforce controls
• Able to operate independently as a second line of defense

🎁 Benefits

• Travel up to 10% for onboarding, client or partner work
• Generous health, welfare, and wellbeing benefits