Manager, CyberSecurity Risk Management

The Information Security organization advances the overall state of security at Rubrik through critical initiatives and coordination of large security projects. Information Security builds technologies, tools, and processes to better enable teams at Rubrik to develop secure software and protect data and systems with appropriate security controls. Information Security also develops systems to monitor and respond to attacks against our assets, provides awareness education to teams on security best practices for data protection, and ensures data governance and data sharing relationships with third parties in order to securely protect Rubrik information.

We are looking for a Manager, CyberSecurity Risk Management to join our security risk management team and support the delivery of Rubrik's cybersecurity risk management program. Working closely with the team's lead Program Manager, who owns the program, you will help drive day-to-day execution: coordinating cross-functional risk assessments, supporting risk review and acceptance processes, tracking risk remediation to closure, and producing risk reporting that gives leadership a clear view of Rubrik's cybersecurity risk posture. You will partner with Security, Engineering, Product, IT, Legal, Procurement, and Finance to keep work on track and deliver measurable outcomes. Success in this role requires strong program management discipline, solid risk and compliance knowledge, and the ability to influence and build consensus at every level of the company.

• Support program operations for the overall Cybersecurity Risk Management Program.

• Support and conduct risk assessments and triage incoming security issues related to Rubrik’s core products, services, and infrastructure.

• Draft clear risk statements that translate technical findings into business impact, including likelihood/impact rationale and key assumptions.

• Maintain and update the risk register, ensuring ownership, status, target dates, and risk treatment decisions are accurate and timely.

• Coordinate and track cross-functional risk initiatives, managing timelines, dependencies, and action items; flag delivery risks early and drive follow-through.

• Drive remediation of risks to closure by conducting periodic cross-functional check-ins with risk owners to obtain updates, track milestones and target dates, document progress in the risk register, remove/escalate blockers, and communicate status through leadership reporting.

• Support the risk governance cadence, including preparing materials for risk committee meetings, facilitating risk acceptance and exception reviews, and tracking escalations, decisions, and actions to completion.

• Collect and analyze program metrics (KPIs/KRIs), build dashboards, and help prepare risk updates for leadership.

• Support the risk assessment program at scale, including enterprise, technical, and third-party/supplier risk assessments, helping keep methodology, quality, and turnaround times consistent.

• Execute and document cybersecurity risk assessments (inherent and residual) for systems, applications, cloud services, and initiatives; gather evidence and validate control implementation with stakeholders.

• Help map program activities to compliance obligations and frameworks (ISO 27001, SOC 2, FedRAMP, NIST CSF/800-53, PCI DSS, HIPAA) and emerging regulations (e.g., DORA, NIS2, EU AI Act).

• Contribute to risk quantification efforts so risks can be prioritized in business and financial terms.

• Support GRC tooling, automation, and AI-enabled improvement initiatives by gathering requirements, coordinating implementation tasks, piloting use cases (e.g., LLM-assisted intake triage, evidence mapping, and automated status summarization), and driving adoption