Technical Risk Manager - Sr. Security Engineer I

Owns Smartsheet's security risk management programme end to end and oversees its third-party risk management function, reporting to the Senior Director, GRC Engineering, with the choice of Bellevue or remote work in the US. The job calls for enough technical understanding to judge exposure and explain it in business terms, rather than hands-on engineering.

The work spans identifying, scoring and quantifying risk with FAIR or similar methods, keeping the enterprise risk register useful for decisions, reviewing new initiatives and architecture changes, driving mitigation plans with risk owners, running vendor tiering, assessments and monitoring, and reporting KRIs to leadership. Smartsheet wants four or more years in security risk or GRC including ownership of a risk register, TPRM experience, a CRISC, CISSP, CISM or similar certification, and familiarity with tools such as Archer or OneTrust.