Senior Security Engineer – Technical Risk Manager

This is a fully remote position, open to applicants in Washington.

📋 Description

• Take ownership and enhance Smartsheet's Security Risk Management program, which encompasses risk identification, analysis, scoring, and quantification across internal systems, third-party vendors, and emerging initiatives.

• Manage the enterprise risk register, ensuring that ratings, ownership, mitigation status, and residual risk are accurately maintained.

• Lead the risk analysis and review processes for new initiatives, architectural changes, and critical findings.

• Convert technical exposures into business-relevant risk statements for the leadership team.

• Create and implement risk mitigation strategies in collaboration with risk owners across engineering, IT, and business departments.

• Define remediation plans, ensure they are tracked to completion, and escalate any items that are stalled.

• Supervise Smartsheet's Third-Party Risk Management program, which includes vendor risk tiering, reviewing security assessments/questionnaires, ongoing monitoring, and issue tracking.

• Develop and present risk reports and KPIs/KRIs to both security and business leadership.

• Collaborate with GRC, Field Security Engineering, and engineering leads to incorporate audit, penetration test, and questionnaire findings into the risk register and prioritization process.

• Report directly to the Senior Director of GRC Engineering.

⛳️ Requirements

• A minimum of 4 years of experience in security risk management, enterprise risk, or GRC, with direct responsibility for a risk register and the risk assessment process.

• Familiarity with risk quantification methods (such as FAIR, OCTAVE, or similar approaches).

• Technical knowledge to comprehend cloud architecture, application security concepts, and common vulnerability/risk findings.

• Experience in managing or significantly supporting a Third-Party Risk Management program, including vendor tiering, questionnaire reviews, and ongoing monitoring.

• Exceptional written and verbal communication skills.

• Strong organizational abilities and comfort in managing multiple concurrent risk items and vendor relationships.

• Professional certifications such as CRISC, CISSP, CISM, or equivalent are required.

• Experience with GRC or TPRM tools like Vanta, Drata, OneTrust, Archer, or ServiceNow GRC.

• Background in supporting SOC 2, ISO 27001, or FedRAMP programs is preferred.

• Proven experience presenting risk posture to senior leadership or board-level audiences.

• Must be legally eligible to work in the U.S. on an ongoing basis.

🏝️ Benefits

• Employer-subsidized medical/vision and dental coverage for full-time employees.

• 401k Match to assist you in saving for your future (50% of your contribution up to the first 6% of your eligible pay).

• Monthly stipend provided to enhance your work and productivity.

• Flexible Time Away Program along with Sick Time Off.

• U.S. employees automatically receive Smartsheet-sponsored life insurance, short-term, and long-term disability coverage.

• 12 paid holidays per year for U.S. employees.

• Up to 24 weeks of Parental Leave.

• One personal paid Volunteer Day to contribute to our community.

• Opportunities for professional growth and development, including access to Udemy online courses.

• Company-funded perks such as a counseling membership, local retail discounts, and a personal Smartsheet account.

• Teleworking options available from any registered location in the U.S. (specific to the role).

• Competitive market incentive opportunities.