Security Governance & Compliance Manager

About the role

Cisco is looking for a Security Governance & Compliance Manager in San Jose. The role supports risk owners and senior leadership with the information needed to make informed risk decisions, taking the lead on the most complex, ambiguous or high-visibility risk work. It owns technical security risk assessments end-to-end, drives remediation and residual-risk decisions, and represents the risk program in executive and audit forums. The person works with significant independence, mentors other analysts and represents Risk Management where technical leaders and executives make real decisions.

Key responsibilities

• Lead complex, ambiguous or cross-functional technical risk assessments independently, using AI-assisted assessment tools where applicable.
• Act as a trusted advisor to senior technical leaders and executives on risk posture, prioritization and trade-offs.
• Develop and deliver executive-level risk reporting, metrics and trend analysis, translating technical risk into business impact for the CISO, leadership and the board.
• Own escalation and negotiation on high-risk exception requests and complex remediation disputes, assessing residual risk and compensating controls independently.
• Monitor the risk portfolio at program level, identify systemic gaps or patterns and drive process, tooling or automation improvements; maintain and improve risk register data quality.
• Lead support for internal and external audits, including evidence packages, documentation and process walkthroughs.
• Build strong relationships with engineering leaders and business unit executives, and lead difficult, high-stakes conversations with them.
• Mentor and guide junior and mid-level risk analysts.

Required profile

• Bachelor's degree or equivalent work experience.
• Professional certification such as GIAC, CISSP, CRISC, CISM, CISA, ISO 27001 LI/LA, CCSK or CCSP.
• 7-10+ years of hands-on technical risk assessments in a security risk management role, including independently owning complex or ambiguous assessments end-to-end.
• Extensive hands-on experience leading assessments and audits against frameworks such as NIST CSF/RMF, ISO 27001/27002, ISO 42001 and NIST AI RMF.

Required skills

• Deep cloud technical knowledge (AWS, Azure, GCP): able to evaluate an architecture, find non-obvious control gaps and advise engineering leaders on remediation.
• Preferred: Splunk products and SPL, Python or SQL for risk metrics and automation, mentoring analysts, and presenting to board-level or executive governance forums.