Director of Cyber Risk Management, Business Resilience, and Security Culture

Rubrik is seeking a highly experienced and strategic Director of Cyber Risk Management, Business Resilience, and Security Culture to lead our efforts in identifying, assessing, mitigating, and monitoring cyber risks across the organization. This role is pivotal in ensuring the continuity of business operations in the face of cyber threats and fostering a strong, proactive security-aware culture. In partnership with the Sr. Director of GRC, the Director will be responsible for developing and implementing comprehensive strategies for cyber risk management, enhancing business resiliency capabilities, and driving security awareness and education programs. This role requires a strong leader with deep technical expertise, excellent communication skills, and a proven track record in influencing risk owners to drive accountability in reducing Rubrik’s risk profile and ensuring the appropriate security posture.  In addition, a strong team exists to support the Director in these areas. Therefore, maintaining Rubrik’s culture and retaining talent is a primary responsibility for this role.

Key Responsibilities

Cyber Risk Management:

• Lead and oversee the continuous evolution and operationalization of the cyber risk management program and operating the Risk Management Lifecycle, ensuring alignment with industry best practices (e.g., NIST, ISO 27001).
• Influence business/risk owners to drive risk accountability and proactive reduction of cyber risks and ensure the security posture aligns with business objectives and risk appetite.
• Strategize and prioritize regular cyber risk assessments, identifying vulnerabilities, threats, and potential impacts to critical assets and business processes.
• Lead the cyber risk team and third party security team in delivering the outcomes associated with the Risk Management Lifecycle, providing oversight of Rubrik’s risk register and findings boards, prioritizing and tracking the remediation of identified risks, working closely with IT, engineering, and business units.
• Leverage existing tools for risk quantification to help risk and business owners understand the overall Return on Investment (ROI) associated with risk mitigating initiatives and their impact on the security posture in terms of investment and return.
• Provide comprehensive cyber risk reporting, including monthly operational reports, monthly executive summaries, and quarterly board-level presentations.

Business Resiliency (Disaster Recovery & Business Continuity):

• Provide strategic oversight and direction for Rubrik's business continuity and disaster recovery programs, ensuring alignment with overall business objectives and risk appetite.
• Develop and evolve the long-term strategy for enhancing organizational resilience against various disruptions, including cyberattacks, natural disasters, and operational failures.
• Guide and support strong leaders reporting into this role in the execution of business continuity and disaster recovery plans, including regular testing, simulation exercises, and post-incident reviews.
• Establish and monitor key metrics for business resiliency, ensuring continuous improvement and adherence to established recovery time objectives (RTOs) and recovery point objectives (RPOs).
• Collaborate with key stakeholders to integrate resiliency considerations into strategic planning and major initiatives.

Security Culture & Awareness:

• Define and drive the strategic vision for a pervasive and proactive security culture across the entire organization, ensuring it is embedded in all aspects of business operations.
• Guide and empower the strong program manager reporting into this role to design and implement innovative awareness campaigns, educational content, and communication strategies that foster individual accountability and promote secure behaviors.
• Establish metrics and reporting mechanisms to assess the impact and effectiveness of security culture initiatives, continuously refining the approach based on organizational needs and evolving threat landscapes.
• Champion security as a shared responsibility, working with senior management to ensure adequate resources and support for cultural transformation efforts.

Governance & Compliance:

• Strategically contribute to the governance and compliance programs and collaborate with leaders of those programs to ensure gaps in control efficacy and policy exceptions flow into the Risk Management Lifecycle.
• Support internal and external audits related to cyber risk, business resilience and security culture.

Stakeholder Engagement:

• Collaborate cross-functionally with Security Operations and other security champions to identify and record findings to trigger the Risk Management Lifecycle.
• Collaborate and partner with  IT, Legal, Procurement, HR, Audit and various business units to integrate security and resiliency into business processes.
• Communicate complex cyber risk and resiliency concepts to technical and non-technical audiences, including executive leadership.
• Provide strategic direction and oversight of relationships with external vendors and partners related to cyber risk, resiliency, and security awareness.

Qualifications

• 15+ years of progressive experience in information security, preferably inhouse within a SaaS organization, with at least 8 years in a leadership role focused on cyber risk management, business continuity, and security awareness.
• Demonstrated expertise in cyber risk assessment methodologies and frameworks (e.g., NIST RMF, ISO 27005).
• Strong understanding of business continuity and disaster recovery planning principles and practices (e.g., ISO 22301, BCI Good Practice Guidelines).Proven experience in developing and delivering effective security awareness and training programs.
• Excellent written and verbal communication skills, with the ability to articulate complex security concepts to diverse audiences.
• Strong analytical and problem-solving abilities.
• Ability to work independently and collaboratively in a fast-paced environment.
• Proven track record in hiring highly talented individuals and ability to retain talent
• Emotional intelligence necessary to lead a high performing team and maintain Rubrik’s culture and values (Resilience, Integrity, Velocity, Excellence & Transparency

Preferred Qualifications

• Bachelor's degree in Computer Science, Information Security, Business Administration, or a related field.
• Master's degree in a relevant field.
• Relevant industry certifications such as CISSP, CISM, CRISC, CBCP, or equivalent.
• Experience in a highly regulated industry but understanding of risk associated with a SaaS organization delivering for customers that are in a highly regulated environment.
• Familiarity with Jira, Confluence and risk quantification tools
• Experience with cloud security risks and controls (AWS, Azure, GCP).
• Unique ability to roll up sleeves and get involved in the tactics while also developing strategy, building, and leading a team

Rubrik provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Rubrik complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

#LI-KY1