As a member of the IT Management Team, you are responsible for managing, developing, and leading a team of employees. Your role includes leading the specific functional responsibilities of your team, which involves overseeing team performance and deliverables. However, your role as a leader within our organization requires more than the management of resources and day-to-day operations. As a steward of the company, you are charged with the development and execution of your team's strategic vision and plan and ensuring that your team's actions align with the larger goals of the company and the IT Division.
We are seeking a dynamic and experienced
Manager of Security Risk Management to join our Security Risk and compliance team. This role will be pivotal in setting and implementing our risk management strategy, including overseeing the identification and assessment of security risks, the design and implementation of automated risk and control assessment processes, and managing a centralized risk register and reporting that drives decision making.
As a key leader, you will build and manage a small, highly skilled team, driving innovation in security risk management calibrations and operations, and will work closely with security teams, privacy experts, legal, and other IT and business leaders to provide actionable insights and drive risk based decision making across the organization.
As the primary conduit between your employees and upper leadership, your role in communicating and modeling the values and guiding principles of our company culture is of vital importance. All members of IT Management should strive to consciously and consistently foster a culture of engagement, trust, and "open door" communication.
ROLE- INTEGRITY: When achieving benchmarks and goals, use methods/strategies that are consistent with the Code of Ethics and the Standard of Ethics for Managers and Supervisors. Always leads by example. Appropriately handles employee concerns and follows through to resolution.
- MEMBER SERVICE: Provides and ensures staff provides an exceptional member experience.
- ADMINISTRATION: Ensures proper department coverage (writing schedule and break aids if needed). Understands department budget, able to research and explain budget variances.
- MANAGING PERFORMANCE:Coaches and mentors employees to provide support and guidance. Has regular open and honest conversations with employees to discuss work performance and career development. Identifies learning opportunities to strengthen employee knowledge, skill and ability.
- COMMUNICATION:Regularly shares information with employees via meetings and one-on-one conversations. Successfully navigates difficult conversations with employees, members, and suppliers. Listens, expresses empathy and adapts to get points across. Addresses issues immediately to ensure a timely resolution and to avoid escalating the situation. Consistently demonstrates business knowledge during interactions with senior management.
- SELF-MANAGEMENT:Demonstrates sound judgment, taking a partner when necessary. Ability to maintain self-control in the face of hostility or provocation or in intense, hectic situations.
- INCLUSION: Encourages different approaches and ideas to work and to accomplish goals. Seeks employee input. Takes the time to get to know or reach out to candidates who show potential that may not come forward on their own.
- COMPLIANCE AND SAFETY: Takes measures to ensure employee and member information is kept confidential and adheres to IS security policy.
- LEADERSHIP & TEAM DEVELOPMENT: Build and lead a high-performing team of security risk professionals, provide coaching and career development opportunities to team members, and foster a collaborative and innovative environment.
- RISK MANAGEMENT STRATEGY & OPERATIONS: Develop, implement, and maintain a comprehensive security risk management strategy, and its ongoing operations to identify, assess, and prioritize security risks to the organization.
- AUTOMATED RISK & CONTROL VALIDATIONS: Lead the identification and implementation of solutions to automate risk and control assessments.
- COMMUNICATION & REPORTING: Develop and maintain centralized risk register and reporting mechanisms for security risk management to ensure transparency and accountability, and collaborate with other departments to communicate risk trends and mitigation strategies.
- MEASURE & REPORT PROGRAM EFFECTIVENESS: Define appropriate KPIs and measures for team success; provide leadership with periodic reporting on results and impact
- This is a full-time management/leadership position (45+ hours per week).
- Regular and reliable workplace attendance at your assigned location.
- Ability to operate vehicles, equipment or machinery.
- Computer, phone, printer, copier, fax
REQUIRED- 8+ years of experience in security/compliance risk management, technology audit or related fields.
- At least 3 years experience leading security, compliance or risk teams in a management or supervisory role preferred.
- Strong understanding of Information Security and Security Governance, Risk and Compliance frameworks, methodologies, and practices.
- Technical security and architecture knowledge with the ability to recognize, analyze and troubleshoot issues, and articulate those to both technical and non-technical audiences
- Strong leadership and team management skills, with a demonstrated ability to lead cross-functional teams and drive organizational change
- Superb communication and relationships skills, especially the ability to understand and articulate advanced technical topics to non-technical audiences and build consensus among partners and leadership.
- Serves as subject matter expert for enterprise security risk assessments, risk response, and risk management programs.
- Aggregates and analyzes risk signals from vulnerability management, threat intelligence, cloud security, third party risks and other security domains to inform risk decisions and priorities.
- Researches and monitors emerging risks associated with new technologies such as Artificial Intelligence (AI), implementations, and configurations, applying industry best practices to reduce organizational exposure.
- Understands regulatory and compliance requirements that impact security and collaborates with business and project teams to develop risk-appropriate solutions, including supporting audit activities.
- Presents risk posture, technical findings, and recommendations to executives, management, and cross-functional audiences to build consensus and drive decisions.
- Leverages AI-powered tools to enhance risk identification, prioritization, and reporting workflows, identifying opportunities to responsibly automate risk processes.
- Automates, documents, educates, and delegates risk processes to improve efficiency and scalability across the team.
- HIPAA Training and Supervisors Orientation (within 30 days of hire); Leadership Development 101 (within one year); Costco Pay Policies (within 90 days of promotion).
Recommended- Bachelor's degree in Information Technology, Artificial Intelligence, Cybersecurity, Risk Management, or related field
- Relevant certifications such as CISSP, CISM, or CRISC
- Proficient in Google Workspace applications, including Sheets, Docs, Slides, and Gmail.
Required Documents• Cover Letter
• Resume
• Last two performance reviews
• Attendance records for current year (Do not include absences covered by paid sick/personal time,
FMLA or other protected absences.)
California applicants, please click here to review the Costco Applicant Privacy Notice.
