Director, Governance, Risk & Compliance

Redwood City, CAG&A – CEO/Legal /Full-time /HybridCompany Description:Anomali, headquartered in Silicon Valley, delivers the first Intelligence-Native Agentic SOC Platform — unifying a security data lake, the world's largest IOC repository, threat intelligence, and agentic AI into a single modern experience. The platform accelerates detection, investigation, and response, delivering earlier insights, faster action, and scalable modernization across any environment.Whether augmenting existing tools or delivering complete SOC capabilities end-to-end, Anomali empowers security teams to operate faster, smarter, and with confidence.Beyond Detecting. Start Deciding. Start Acting.Learn more at Position Overview:Anomali is scaling its compliance program to support an AI-native cybersecurity platform used by governments and enterprises worldwide. We're looking for a hands-on GRC leader who can own and drive our multi-jurisdiction certification portfolio — spanning U.S. federal (FedRAMP), global (ISO 27001, SOC 2), and regional cloud security frameworks (UAE DESC, Saudi Arabia NCA/CCC, Australia IRAP) — while building the scalable compliance infrastructure to support continued international expansion.This is a builder role, not a maintainer role. You'll be the single point of accountability for keeping our certifications current, audit-ready, and strategically sequenced to unlock new markets and revenue.Key Responsibilities:Program Ownership & StrategyOwn the end-to-end GRC roadmap across FedRAMP, ISO 27001, SOC 2, DESC (Dubai Electronic Security Center), Saudi NCA Cloud Cybersecurity Controls (CCC), Australia IRAP, and other regional cloud security/data residency frameworks as they arisePrioritize and sequence certification efforts against GTM and revenue targets, in partnership with sales, product, and executive leadershipServe as the primary liaison with assessors, auditors, and regulatory bodies (3PAOs, sponsoring agencies, in-country assessors)FedRAMPManage ongoing FedRAMP authorization activities (ATO maintenance, continuous monitoring, SAR/POA&M remediation) in partnership with the 3PAO and sponsoring agencyOwn documentation quality (SSP, SAR, POA&M) and escalation management when assessor deliverables fall shortISO 27001Maintain and evolve the ISMS, manage internal/external audit cycles, and drive continuous improvement of controls, risk assessments, and policy frameworksSOC 2Own SOC 2 Type II audit readiness and execution (Security, Availability, and Confidentiality trust services criteria) in partnership with the external audit firmManage evidence collection, control testing, and remediation of exceptions across annual audit cyclesEnsure alignment between SOC 2 controls and overlapping ISO 27001/FedRAMP requirements to avoid duplicated audit effortRegional Cloud/Government CertificationsDrive DESC CSP certification for UAE market access. The CSP Security Standard is based on the following international standards, which the candidate should be conversant in: ISO/IEC 27001:2013ISO/IEC 27002:2013ISO/IEC 27017:2015ISR:2017 v.02CSA Cloud Controls Matrix 3.0.1Manage Saudi NCA compliance (ECC/CCC) in coordination with local partnersOwn Australia IRAP assessment process and coordination with registered assessorsMonitor emerging regional requirements (e.g., additional Gulf, APAC, or EU frameworks) and advise on prioritizationRisk & ControlsBuild and maintain a unified controls framework that maps overlapping requirements across all frameworks to avoid duplicated effortOwn enterprise risk register, vendor/third-party risk management, and remediation trackingPartner with engineering and product teams to ensure security controls are designed in, not bolted onCross-Functional LeadershipPartner with internal cross-functional teams — IT, Security, Cloud Infrastructure, Engineering, and Product — to own and drive compliance outcomes end-to-endSupport customer/prospect due diligence (security questionnaires, audit requests, trust portal)Partner with legal on regulatory obligations, data residency, and contractual compliance commitmentsReport compliance posture and risk to executive leadership and board as needed Qualifications Required Skills/Experience: 8+ years in GRC, information security compliance, or related audit/assurance roles, with 3+ years in a leadership capacityDirect, hands-on experience with FedRAMP (Moderate or High) as a CSP-side practitioner — not just advisoryDemonstrated ownership of ISO 27001 certification and ongoing ISMS managementDemonstrated ownership of SOC 2 Type II audits, from readiness through report deliveryExperience with at least one Middle East cloud security framework (DESC, Saudi NCA/CCC, or equivalent)Familiarity with Australia IRAP assessment processStrong working knowledge of cloud security architecture (AWS/Azure/GCP) and how controls map to technical implementationExcellent stakeholder management — comfortable working directly with C-suite, auditors, and government sponsorsExceptional written communication skills (SSPs, policies, board-level reporting)For candidates residing within commutable distance of Redwood City, CA, this position will be hybrid. Remote candidates based in the US, will also be considered.This position is not eligible for employment visa sponsorship. The successful candidate must not now, or in the future, require visa sponsorship to work in the US.Preferred QualificationsCertifications: CISSP, CISA, CISM, or ISO 27001 Lead Auditor/ImplementerExperience in a high-growth, venture-backed SaaS or cybersecurity companyPrior experience managing multiple concurrent certifications across regionsExperience with GRC tooling (Vanta, Drata, ServiceNow GRC, or similar)What Success Looks LikeFedRAMP ATO maintained with zero material findings; audit cycles run predictablyISO 27001 recertification and surveillance audits pass without major nonconformitiesSOC 2 Type II report delivered annually with no material exceptionsDESC, Saudi CCC, and IRAP certifications achieved on committed timelines, unlocking regional dealsA documented, reusable controls framework that reduces redundant audit effort across all certificationsCompliance treated as a competitive differentiator in sales cycles, not a bottleneckEqual Opportunities MonitoringIt is our policy to ensure that all eligible persons have equal opportunity for employment and advancement on the basis of their ability, qualifications and aptitude. We select those suitable for appointment solely on the basis of merit without regard to an individual's disability, race, color, religion, sex, sexual orientation, gender identity, national origin, age, or status as a protected veteran. Monitoring is carried out to ensure that our equal opportunity policy is effectively implemented. If you are interested in applying for employment with Anomali and need special assistance or accommodation to apply for a posted position, contact our Recruiting team at [email protected].Compensation Transparency$180,000 - $230,000 USD Please note that the annual base salary range is a guideline and, for candidates who receive an offer, the base pay will vary based on factors such as work location, as well as, knowledge, skills and experience of the candidate. In addition to base pay, this position is eligible for benefits, and may be eligible for a bonus and/or equity.We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.