Manager, Security Risk Controls

The Manager, Security Controls Management is responsible for the execution, governance, assurance, and continuous improvement of the enterprise security controls program. This role serves as the process owner for security controls, ensuring controls are defined, documented, implemented, measured, and maintained consistently across the organization.

Operating as an individual contributor and process leader, this role partners closely with Security, Risk, Compliance, Internal Audit, Privacy, and business stakeholders to drive effective control management practices. The Manager is accountable for the health and maturity of the security controls program, including control lifecycle management, control effectiveness validation, issue remediation tracking, and audit readiness.

This position does not have direct people management responsibilities but requires strong leadership through influence, coordination, and stakeholder engagement across multiple functions.

Key Responsibilities:

Security Controls Governance & Management

• Own and manage the lifecycle of security controls, including control definition, implementation, maintenance, review, and retirement.
• Establish and maintain a centralized inventory of security controls and associated control documentation.
• Ensure security controls remain aligned with corporate security requirements, policies, standards, and regulatory obligations.
• Define and maintain control ownership, accountability, and governance processes.
• Drive continuous improvement of the security controls framework and supporting methodologies.
• Lead continuous improvement initiatives that enhance governance, standardization, reporting, and overall control maturity.

Control Design & Effectiveness

• Partner with control owners and subject matter experts to establish scalable, risk-based security controls that support evolving business, regulatory, and security requirements.
• Assess control design and operating effectiveness to ensure intended objectives are achieved.
• Identify control gaps, weaknesses, and opportunities for improvement.
• Coordinate periodic control reviews and validation activities.
• Support development of compensating controls when necessary to address identified risks or operational constraints.

Cross-Functional Coordination

• Collaborate with various security teams, Risk Management, Compliance, Privacy, and Internal Audit teams to ensure consistent control implementation and operation.
• Facilitate discussions regarding control ownership, responsibilities, remediation activities, and control performance.
• Coordinate control-related initiatives across multiple stakeholders and business functions.
• Drive accountability for completion of control-related deliverables and commitments.
• Build trusted partnerships across security, compliance, privacy, audit, and business organizations to drive governance, accountability, and successful execution of security assurance activities.

Documentation & Evidence Management

• Ensure security control documentation is accurate, complete, and maintained within designated systems of record.
• Maintain traceability between security requirements, controls, procedures, and supporting evidence.
• Establish documentation standards to support consistency, audit readiness, and operational effectiveness.
• Validate the quality and completeness of evidence supporting control operation.
• Support the development and maintenance of control narratives, procedures, standards, and process documentation.
• Establish documentation and evidence management practices that support repeatable assurance activities and audit readiness.

Issue, Risk & Remediation Management

• Identify, document, and track control deficiencies, gaps, and improvement opportunities.
• Partner with stakeholders to develop remediation plans and corrective actions.
• Monitor remediation progress and escalate issues that may impact control effectiveness or compliance obligations.
• Assess the potential risk impact associated with identified control weaknesses.
• Support risk acceptance and exception management processes when applicable.
• Prioritize remediation efforts based on risk and provide governance oversight to ensure timely resolution of control deficiencies.

Metrics, Reporting & Continuous Improvement

• Develop and maintain key performance indicators (KPIs) and key risk indicators (KRIs) for the security controls program that measure program health.
• Establish reporting that provides meaningful visibility into governance assurance, compliance initiatives, remediation progress, and overall program health.
• Analyze program data and trends to identify improvement opportunities.
• Provide regular status reporting and executive-level program updates.
• Drive initiatives that improve efficiency, automation, and overall control maturity.

Assessment Support

• Support internal and external audits by facilitating evidence collection and validating control documentation.
• Coordinate responses to assessment findings and recommendations.
• Maintain the enterprise security assurance posture through ongoing assessment and remediation tracking.
• Support regulatory, customer, and third-party assessments involving security controls.

Basic Qualifications:

• Bachelor's degree in Cybersecurity, Information Systems, Information Technology, Business, Engineering, or a related field.
• 7+ years of experience in cybersecurity, security governance, risk management, compliance, internal controls, audit, or related disciplines.
• Demonstrated experience managing security controls, control frameworks, or governance programs.
• Experience supporting audits, assessments, and remediation activities.