Manager, IT Risk Operations

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Manager, IT Risk Operations based in United States.

This is a high-impact leadership role within a sophisticated Governance, Risk & Compliance environment, connecting technology, cybersecurity, privacy, and operational risk. You will manage a small team while partnering closely with senior IT, Security, Legal, and business leaders. The role focuses on strengthening IT governance, controls, risk reporting, and operational resilience across a complex global organization. You will turn technical and security data into actionable executive insights through sophisticated KPI and KRI reporting. You will also oversee ITSM governance, ServiceNow analytics, incident investigations, and vendor risk management. The position offers the opportunity to modernize risk processes through automation, data-driven oversight, and continuous improvement. It can be performed fully remotely or in a hybrid model for candidates located near a physical office.

Accountabilities:: IT governance and risk management: Lead executive reporting on IT risk, compliance posture, operational performance, and control effectiveness, while maintaining and evolving the IT risk register and Risk & Control Self-Assessment program.

Risk analytics and reporting: Develop KPI and KRI dashboards that provide visibility into emerging risk trends, control performance, and operational issues, translating complex technology and security data into clear recommendations for senior leadership.

Controls and compliance: Ensure adherence to IT policies, standards, and leading frameworks such as NIST and ISO/IEC 27001, while identifying systemic and emerging risks across technology, security, privacy, and operational processes.

Incident governance and investigations: Partner with Legal, Security, and IT stakeholders to support and lead internal investigations and ensure appropriate governance and follow-through.

ITSM governance: Oversee governance and reporting across the IT Service Management ecosystem, analyzing incident, change, and problem-management data to identify trends, control gaps, and opportunities for operational improvement.

ServiceNow optimization: Drive workflow optimization, reporting enhancements, and automation within ServiceNow to improve IT service visibility and operational efficiency.

Vendor risk management: Review and advise on vendor agreements while strengthening risk tiering, assessment, monitoring, reporting, and governance processes.

Process improvement: Identify opportunities to streamline risk and compliance processes, enhance reporting, improve controls, and introduce data-driven approaches to technology risk management.

Team leadership: Manage and support a small team while fostering accountability, collaboration, analytical rigor, and continuous improvement.

Stakeholder partnership: Work closely with senior IT, Security Engineering, Legal, and organizational leadership to establish a consistent, practical, and measurable approach to technology risk.

Requirements:

Education: Bachelor’s degree preferred.

Experience: Approximately 7+ years of experience in IT risk, security compliance, technology audit, IT governance, or a related discipline.

Regulated environments: Experience working in complex or regulated organizations, such as legal services, financial services, consulting, or similarly sophisticated environments, is preferred.

Risk and controls expertise: Strong understanding of control design, risk registers, RCSA programs, audit response, and technology governance.

Framework knowledge: Working knowledge of NIST Cybersecurity Framework, ISO/IEC 27001, and SOC 2.

ITSM expertise: Familiarity with ServiceNow and ITSM reporting, including incident, change, and problem-management lifecycles.

Technology knowledge: Experience with Microsoft 365, Purview, email security technologies, and related security and collaboration platforms.

Analytics: Proven ability to lead reporting, analytics, governance initiatives, and data-driven risk programs.

Privacy: Basic understanding of applicable privacy regulations and their implications for technology and operational risk.

Leadership and communication: Ability to manage a team, influence senior stakeholders, communicate complex risk topics clearly, and translate data into practical business recommendations.

Certifications: CISA, CISSP, CRISC, CTPRM, and/or ITIL certifications are preferred.

Work arrangement: The role may be performed 100% remotely or through a hybrid arrangement for candidates located near one of the organization's physical offices.

Benefits:

Competitive annual salary:

Palo Alto, New York, and San Francisco: $163,200–$220,800 .

Austin, Boston, Boulder, Century City, Los Angeles, Salt Lake City, San Diego, and Seattle: $147,050–$198,950 .

Compensation may vary based on qualifications, experience, education, certifications, and work location.

Potential discretionary year-end merit bonus based on performance.

Competitive overall benefits package.

Professional and personal development opportunities.

Flexible remote or hybrid work environment.

Work-life balance supported through a team-oriented and collaborative culture.

Opportunities to contribute to a sophisticated technology, security, and risk environment spanning multiple business and geographic locations.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!  Why Apply Through Jobgether?    Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.     #LI-CL1