Director of Cyber Risk Management, Business Resilience, and Security Culture

Summary

Join Rubrik as the Director of Cyber Risk Management, Business Resilience, and Security Culture, leading efforts in identifying, assessing, mitigating, and monitoring cyber risks. Partner with the Sr. Director of GRC to develop and implement comprehensive strategies for cyber risk management, enhancing business resiliency, and driving security awareness. This pivotal role requires a strong leader with deep technical expertise, excellent communication, and a proven track record in influencing risk owners. Maintain Rubrik’s culture and retain talent are also primary responsibilities. The role involves leading a team, overseeing risk management programs, and collaborating with various departments. Success requires strong leadership, technical expertise, and communication skills.

Requirements

• 15+ years of progressive experience in information security, preferably inhouse within a SaaS organization, with at least 8 years in a leadership role focused on cyber risk management, business continuity, and security awareness
• Demonstrated expertise in cyber risk assessment methodologies and frameworks (e.g., NIST RMF, ISO 27005)
• Strong understanding of business continuity and disaster recovery planning principles and practices (e.g., ISO 22301, BCI Good Practice Guidelines)
• Proven experience in developing and delivering effective security awareness and training programs
• Excellent written and verbal communication skills, with the ability to articulate complex security concepts to diverse audiences
• Strong analytical and problem-solving abilities
• Ability to work independently and collaboratively in a fast-paced environment
• Proven track record in hiring highly talented individuals and ability to retain talent
• Emotional intelligence necessary to lead a high performing team and maintain Rubrik’s culture and values (Resilience, Integrity, Velocity, Excellence & Transparency

Responsibilities

• Lead and oversee the continuous evolution and operationalization of the cyber risk management program and operating the Risk Management Lifecycle, ensuring alignment with industry best practices (e.g., NIST, ISO 27001)
• Influence business/risk owners to drive risk accountability and proactive reduction of cyber risks and ensure the security posture aligns with business objectives and risk appetite
• Strategize and prioritize regular cyber risk assessments, identifying vulnerabilities, threats, and potential impacts to critical assets and business processes
• Lead the cyber risk team and third party security team in delivering the outcomes associated with the Risk Management Lifecycle, providing oversight of Rubrik’s risk register and findings boards, prioritizing and tracking the remediation of identified risks, working closely with IT, engineering, and business units
• Leverage existing tools for risk quantification to help risk and business owners understand the overall Return on Investment (ROI) associated with risk mitigating initiatives and their impact on the security posture in terms of investment and return
• Provide comprehensive cyber risk reporting, including monthly operational reports, monthly executive summaries, and quarterly board-level presentations
• Provide strategic oversight and direction for Rubrik's business continuity and disaster recovery programs, ensuring alignment with overall business objectives and risk appetite
• Develop and evolve the long-term strategy for enhancing organizational resilience against various disruptions, including cyberattacks, natural disasters, and operational failures
• Guide and support strong leaders reporting into this role in the execution of business continuity and disaster recovery plans, including regular testing, simulation exercises, and post-incident reviews
• Establish and monitor key metrics for business resiliency, ensuring continuous improvement and adherence to established recovery time objectives (RTOs) and recovery point objectives (RPOs)
• Collaborate with key stakeholders to integrate resiliency considerations into strategic planning and major initiatives
• Define and drive the strategic vision for a pervasive and proactive security culture across the entire organization, ensuring it is embedded in all aspects of business operations
• Guide and empower the strong program manager reporting into this role to design and implement innovative awareness campaigns, educational content, and communication strategies that foster individual accountability and promote secure behaviors
• Establish metrics and reporting mechanisms to assess the impact and effectiveness of security culture initiatives, continuously refining the approach based on organizational needs and evolving threat landscapes
• Champion security as a shared responsibility, working with senior management to ensure adequate resources and support for cultural transformation efforts
• Strategically contribute to the governance and compliance programs and collaborate with leaders of those programs to ensure gaps in control efficacy and policy exceptions flow into the Risk Management Lifecycle
• Support internal and external audits related to cyber risk, business resilience and security culture
• Collaborate cross-functionally with Security Operations and other security champions to identify and record findings to trigger the Risk Management Lifecycle
• Collaborate and partner with IT, Legal, Procurement, HR, Audit and various business units to integrate security and resiliency into business processes
• Communicate complex cyber risk and resiliency concepts to technical and non-technical audiences, including executive leadership
• Provide strategic direction and oversight of relationships with external vendors and partners related to cyber risk, resiliency, and security awareness

Preferred Qualifications

• Bachelor's degree in Computer Science, Information Security, Business Administration, or a related field
• Master's degree in a relevant field
• Relevant industry certifications such as CISSP, CISM, CRISC, CBCP, or equivalent
• Experience in a highly regulated industry but understanding of risk associated with a SaaS organization delivering for customers that are in a highly regulated environment
• Familiarity with Jira, Confluence and risk quantification tools
• Experience with cloud security risks and controls (AWS, Azure, GCP)
• Unique ability to roll up sleeves and get involved in the tactics while also developing strategy, building, and leading a team

Benefits

• Bonus potential
• Equity