Security Governance Lead

About Cohesity

Cohesity leads in AI-driven data security, serving over 13,600 enterprise clients including more than 85 Fortune 100 companies and almost 70% of the Global 500. The company delivers solutions that protect data across on-premises, cloud, and edge environments, supported by major technology partners and headquartered in Santa Clara, CA with a global presence. Cohesity is widely recognized for its innovation, product quality, and workplace culture.

Role Overview

We are seeking a Security Governance Lead responsible for defining and maintaining Cohesity's security policies and Common Controls Framework. This position blends strategic policy development with technical oversight, ensuring controls are both properly defined and effectively monitored through data-driven methods, including AI tools.

Key Responsibilities

• Manage the Cohesity Common Controls Framework, including creation, mapping, and alignment with standards such as ISO 27001, SOC 2, SOX, and GDPR.
• Draft, publish, and communicate security policies and standards, ensuring enforceability and feasibility before formal adoption, aligned with frameworks like NIST and ISO 27001.
• Collaborate with Security and Engineering leadership to address emerging security risks and incorporate solutions into policies and controls.
• Analyze technical control data using various tools and AI-assisted techniques to produce metrics that measure control effectiveness and support scalable program growth.
• Assist internal and external audit processes by working closely with the cyber-Compliance team.
• Maintain documentation and dashboards that track control performance and program key performance indicators, facilitating ongoing improvement.
• Implement, configure, and customize Governance, Risk, and Compliance (GRC) platforms, integrating them with security and IT systems for control mapping, evidence gathering, and posture reporting.
• Work collaboratively with teams from Security, IT, Legal, and Engineering to resolve control and compliance issues as they arise.

Qualifications

• At least 8 years of experience in cybersecurity, IT governance, GRC, or related fields.
• Strong understanding of security frameworks such as NIST CSF, ISO 27001, and CIS Controls.
• Proficiency in interpreting data underlying technical controls and using tools, including AI methods, to develop meaningful control metrics.
• Experience with technical systems generating control evidence, including cloud platforms (AWS, Azure, GCP), identity providers, and IT service/ticketing systems like ServiceNow and Jira.
• Track record in implementing and customizing GRC platforms such as ServiceNow GRC, Archer, or OneTrust.
• Excellent organizational and communication abilities to engage cross-functional stakeholders effectively.
• Knowledge of risk and compliance concepts relevant to enterprise cybersecurity initiatives.
• Bachelor’s degree or equivalent expertise in Cybersecurity, Information Security, Risk Management, Audit, or related disciplines.
• Experience authoring and enforcing security policies, standards, and procedures while collaborating with control owners to ensure practical enforceability.
• Familiarity with audit and compliance requirements including SOC 2, ISO 27001, GDPR, and HIPAA.
• Exposure to risk and control assessments as well as control testing methodologies.
• Background in GRC engineering or security data engineering, including building automated dashboards and monitoring systems for control effectiveness.
• Basic scripting or querying skills (Python, SQL, or similar) for data shaping and automation purposes.
• Industry certifications like Security+, ISO 27001 Lead Implementer, or comparable credentials are advantageous.
• Understanding of security governance in cloud-first, SaaS, or DevOps settings.

Additional Information

This role represents a unique opportunity for an experienced security professional to own cybersecurity governance at a rapidly expanding and security-minded technology company. The position entails influencing policy development, collaborating on evolving security challenges, and leveraging advanced tooling to translate control data into actionable insights, supporting Cohesity’s ongoing success.

Work Location & Expectations: Employees located within a reasonable commute of approximately 45 minutes are expected to work onsite 2-3 days weekly of their choosing. The company prioritizes candidates residing near the job location or willing to relocate with authorization to work in Ireland before start date.

Equal Opportunity: Cohesity embraces diversity and provides equal employment without discrimination based on protected characteristics. Reasonable accommodations are available upon request for applicants with disabilities.

Data Privacy: Candidate personal data processing adheres to company privacy policies.