Director of Governance, Risk & Compliance, Anomali

• 8+ years in GRC, information security compliance, or related audit/assurance roles, with 3+ years in a leadership capacity
• Direct, hands-on experience with FedRAMP (Moderate or High) as a CSP-side practitioner — not just advisory
• Demonstrated ownership of ISO 27001 certification and ongoing ISMS management
• Demonstrated ownership of SOC 2 Type II audits, from readiness through report delivery
• Experience with at least one Middle East cloud security framework (DESC, Saudi NCA/CCC, or equivalent)
• Familiarity with Australia IRAP assessment process
• Strong working knowledge of cloud security architecture (AWS/Azure/GCP) and how controls map to technical implementation
• Excellent stakeholder management — comfortable working directly with C-suite, auditors, and government sponsors
• Exceptional written communication skills (SSPs, policies, board-level reporting)
• For candidates residing within commutable distance of Redwood City, CA, this position will be hybrid. Remote candidates based in the US, will also be considered
• This position is not eligible for employment visa sponsorship. The successful candidate must not now, or in the future, require visa sponsorship to work in the US

Desirable

• Anomali is scaling its compliance program to support an AI-native cybersecurity platform used by governments and enterprises worldwide
• We're looking for a hands-on GRC leader who can own and drive our multi-jurisdiction certification portfolio — spanning U.S. federal (FedRAMP), global (ISO 27001, SOC 2), and regional cloud security frameworks (UAE DESC, Saudi Arabia NCA/CCC, Australia IRAP) — while building the scalable compliance infrastructure to support continued international expansion
• This is a builder role, not a maintainer role. You'll be the single point of accountability for keeping our certifications current, audit-ready, and strategically sequenced to unlock new markets and revenue
• Program Ownership & Strategy:
• Own the end-to-end GRC roadmap across FedRAMP, ISO 27001, SOC 2, DESC (Dubai Electronic Security Center), Saudi NCA Cloud Cybersecurity Controls (CCC), Australia IRAP, and other regional cloud security/data residency frameworks as they arise
• Prioritize and sequence certification efforts against GTM and revenue targets, in partnership with sales, product, and executive leadership
• Serve as the primary liaison with assessors, auditors, and regulatory bodies (3PAOs, sponsoring agencies, in-country assessors)
• FedRAMP:
• Manage ongoing FedRAMP authorization activities (ATO maintenance, continuous monitoring, SAR/POA&M remediation) in partnership with the 3PAO and sponsoring agency
• Own documentation quality (SSP, SAR, POA&M) and escalation management when assessor deliverables fall short
• ISO 27001:
• Maintain and evolve the ISMS, manage internal/external audit cycles, and drive continuous improvement of controls, risk assessments, and policy frameworks
• SOC 2:
• Own SOC 2 Type II audit readiness and execution (Security, Availability, and Confidentiality trust services criteria) in partnership with the external audit firm
• Manage evidence collection, control testing, and remediation of exceptions across annual audit cycles
• Ensure alignment between SOC 2 controls and overlapping ISO 27001/FedRAMP requirements to avoid duplicated audit effort
• Regional Cloud/Government Certifications:
• Drive DESC CSP certification for UAE market access. The CSP Security Standard is based on the following international standards, which the candidate should be conversant in:
• ISO/IEC 27001:2013
• ISO/IEC 27002:2013
• ISO/IEC 27017:2015
• ISR:2017 v.02
• CSA Cloud Controls Matrix 3.0.1
• Manage Saudi NCA compliance (ECC/CCC) in coordination with local partners
• Own Australia IRAP assessment process and coordination with registered assessors
• Monitor emerging regional requirements (e.g., additional Gulf, APAC, or EU frameworks) and advise on prioritization
• Risk & Controls:
• Build and maintain a unified controls framework that maps overlapping requirements across all frameworks to avoid duplicated effort
• Own enterprise risk register, vendor/third-party risk management, and remediation tracking
• Partner with engineering and product teams to ensure security controls are designed in, not bolted on
• Cross-Functional Leadership:
• Partner with internal cross-functional teams — IT, Security, Cloud Infrastructure, Engineering, and Product — to own and drive compliance outcomes end-to-end
• Support customer/prospect due diligence (security questionnaires, audit requests, trust portal)
• Partner with legal on regulatory obligations, data residency, and contractual compliance commitments
• Report compliance posture and risk to executive leadership and board as needed
• What Success Looks Like:
• FedRAMP ATO maintained with zero material findings; audit cycles run predictably
• ISO 27001 recertification and surveillance audits pass without major nonconformities
• SOC 2 Type II report delivered annually with no material exceptions
• DESC, Saudi CCC, and IRAP certifications achieved on committed timelines, unlocking regional deals
• A documented, reusable controls framework that reduces redundant audit effort across all certifications
• Compliance treated as a competitive differentiator in sales cycles, not a bottleneck