Security Governance Lead

Cohesity is the leader in AI-powered data security. Over 13600 enterprise customers including over 85 of the Fortune 100 and nearly 70% of the Global 500 rely on Cohesity to strengthen their resilience while providing Gen AI insights into their vast amounts of data. Formed from the combination of Cohesity with Veritas enterprise data protection business the companys solutions secure and protect data on-premises in the cloud and at the edge. Backed by NVIDIA IBM HPE Cisco AWS Google Cloud and others Cohesity is headquartered in Santa Clara CA with offices around the globe.

Weve been named a Leader by multiple analyst firms and have been globally recognized for Innovation Product Strength and Simplicity in Design and our culture.

Want to join the leader in AI-powered data security

Cohesity is the leader in AI-powered data security. Over 13600 enterprise customers including over 85 of the Fortune 100 and nearly 70% of the Global 500 rely on Cohesity to strengthen their resilience while providing Gen AI insights into their vast amounts of data. Formed from the combination of Cohesity with Veritas enterprise data protection business the companys solutions secure and protect data on-premises in the cloud and at the edge. Backed by NVIDIA IBM HPE Cisco AWS Google Cloud and others Cohesity is headquartered in Santa Clara CA with offices around the globe.
Weve been named a Leader by multiple analyst firms and have been globally recognized for Innovation Product Strength and Simplicity in Design and our culture.

Would you like to join the leader in AI-powered data security

We are looking for a Security Governance Lead who owns both the policy and the proof: deciding what belongs in Cohesitys security policies and Common Controls Framework and staying just as comfortable in the technical data and systems that show whether those controls are actually working. This role suits someone with a strong foundation in cybersecurity governance risk and compliance who also wants to get hands-on with the tooling and data behind a modern security program.

HOW YOULL SPEND YOUR TIME HERE:

• Own the Cohesity Common Controls Framework end to end including control definitions control mapping and alignment to regulatory and industry frameworks (e.g. ISO 27001 SOC 2 SOX GDPR).

• Determine what belongs in Cohesitys information security policies and standards own their lifecycle from drafting through publication and communication and partner with control owners to pressure-test enforceability and feasibility before requirements are codified (e.g. aligned to NIST ISO 27001).

• Work directly with Security and Engineering leadership to frame emerging security challenges and shape solutions that get codified into policy and the controls framework.

• Understand the data behind Cohesitys technical controls and use available tooling including AI-assisted approaches to turn that data into meaningful real time or recurring control effectiveness metrics driving the technology innovation that lets the program scale with the growing company.

• Support internal and external audits by partnering with the cyber-Compliance team.

• Partner with stakeholders to maintain documentation and dashboards that give visibility into control effectiveness and program KPIs supporting continuous improvement.

• Implement configure and customize GRC platform tooling including connecting it to the underlying security and IT systems that feed it to support control mapping evidence collection and posture reporting.

• Collaborate day to day with Security IT Legal and Engineering teams to solve control and compliance problems as they surface.

WED LOVE TO TALK TO YOU IF YOU HAVE MANY OF THE FOLLOWING:

• 8 years of experience in cybersecurity IT governance GRC or related roles.

• Foundational knowledge of security frameworks (e.g. NIST CSF ISO 27001 CIS Controls).

• Comfortable working with the data behind technical controls: knowing where it comes from and able to use available tooling including AI-assisted approaches to turn it into a clear meaningful control metric or status.

• Familiarity with the kinds of technical systems that generate control evidence in a modern security program such as cloud platforms (e.g. AWS Azure GCP) identity providers or IT service and ticketing tools (e.g. ServiceNow Jira).

• Experience implementing and customizing GRC platforms (e.g. ServiceNow GRC Archer OneTrust or similar) not just operating a pre-built instance.

• Strong organizational and communication skills with the ability to engage cross-functional stakeholders.

• Understanding of risk and compliance principles as they relate to enterprise cybersecurity programs.

• Bachelors degree or equivalent experience in Cybersecurity Information Security Risk Management audit or a related field.

• Experience writing maintaining and implementing security policies standards and procedures including working with control owners on whats actually enforceable in practice.

• Familiarity with audit processes and compliance requirements (e.g. SOC 2 ISO 27001 GDPR HIPAA).

• Exposure to risk or control assessments and control testing.

• Background in GRC engineering or security data engineering building recurring control effectiveness monitoring or posture dashboards from technical source systems.

• Basic scripting or query skills (e.g. Python SQL or similar) to help shape validate or automate control data.

• Industry certifications such as Security ISO 27001 Lead Implementer or similar are desirable.

• Knowledge of security governance in cloud-first SaaS or DevOps environments.

This is a great opportunity for a rising security professional to take ownership of cyber security governance at a fast-growing security-conscious tech company. Youll shape what actually goes into policy work directly with Security and Engineering leadership on live security challenges and use modern tooling including AI-assisted approaches to turn control data into meaningful metrics all while working alongside a skilled and collaborative cybersecurity team. This work will directly impact the continued success of Cohesity.

Data Privacy Notice for Job Candidates:

For information on personal data processing please see our .

Equal Employment Opportunity Employer (EEOE)

Cohesity is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race color creed religion sex sexual orientation national origin or nationality ancestry age disability gender identity or expression marital status veteran status or any other category protected by law.

If you are an individual with a disability and require a reasonable accommodation to complete any part of the application process or are limited in the ability or unable to access or use this online application process and need an alternative method for applying you may contact us atCOHESITY or for assistance.

In-Office Expectations

Cohesity employees who are within a reasonable commute (e.g. within a forty-five (45) minute average travel time) work out of our core offices 2-3 days a week of their choosing.

We strongly prefer candidates who are currently located in or near the designated job location. Candidates outside the area should apply only if they are committed to relocating prior to their start date and have the legal right to work in the job location.