Security, Privacy & GRC - Security
Risk Manager
Manager
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a team, its output, its hiring, and its development.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- GRC & Compliance
- Analytics & BI
- Threat Detection (SIEM/EDR/SOAR)
- ITSM / Service Desk
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Own the risk register and its hygiene - currency, taxonomy, and decisions taken
- Run the assessment cadence: identify, analyze, and score new systems, changes, and threats
- Design and calibrate the scoring methodology so two assessors rate a risk the same way
- Plan treatment (mitigate / accept / transfer / avoid) and track whether controls move the score
- Operate the risk-acceptance and exception workflow with owners, conditions, and review dates
- Produce executive and risk-committee reporting: heat maps, trend, decisions needed
- Fold internal, project, process, and vendor risk into one portfolio view
- Maintain KRIs and refresh likelihood against real-world threat signal
The essence of this seat
The Risk Manager runs an organization's security and technology risk-management program: the risk register, the assessment cadence, the scoring methodology, the treatment and acceptance workflow, and the reporting that turns technical findings into business decisions.
Signature move
Frame the scope and the owner before you score. On any incoming risk, the first move is to pin what asset or process is exposed, who owns it (not you), and what the business impact of loss would be - the scope and the owner set the assessment, not the finding that triggered it
What good looks like
reads the divergence as a methodology-calibration failure, not a one-risk error; locates the split on the likelihood axis (raw severity vs reachability); fixes it with anchor scenarios per level and a calibration exercise measuring inter-rater agreement; optimizes for comparability over false precision
Decision rights
- - the risk register and its hygiene, the scoring methodology and calibration, the assessment cadence and scope, risk taxonomy, treatment-plan structure, and which risks are recorded as accepted below the agreed threshold
Working vocabulary
What this role does
The Risk Manager runs an organization's security and technology risk-management program: the risk register, the assessment cadence, the scoring methodology, the treatment and acceptance workflow, and the reporting that turns technical findings into business decisions. This is an individual-contributor / program-owner role - accountable for a register that is accurate and used, not a spreadsheet updated once a year and consulted never. It reports to a security or IT leader (GRC Lead / CISO) and scales the same judgment from a risk function of one to a chartered risk committee.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.