Security Governance Lead

About Cohesity

Cohesity stands at the forefront of AI-driven data security, trusted by over 13,600 enterprise clients, including more than 85 Fortune 100 companies and nearly 70% of the Global 500. The firm was established through the merger of Cohesity and Veritas' enterprise data protection unit, delivering comprehensive data protection across on-premises environments, cloud infrastructures, and edge locations. Headquartered in Santa Clara, CA, and supported by partnerships with major industry players like NVIDIA, IBM, HPE, Cisco, AWS, and Google Cloud, Cohesity has been globally recognized for its innovation, product excellence, and user-friendly design, as well as its workplace culture.

Role Overview

We are currently seeking a Security Governance Lead responsible for managing Cohesity's security policies and the Common Controls Framework (CCF) end to end. This role entails defining controls, ensuring compliance with key industry and regulatory standards, and translating data from technical systems into actionable security metrics. The ideal candidate will have a robust background in cybersecurity governance, risk management, and compliance, combined with hands-on experience with security technology and data.

Key Responsibilities

• Take full ownership of the Common Controls Framework, overseeing control definitions, mapping, and regulatory alignment (including ISO 27001, SOC 2, SOX, and GDPR).
• Define, draft, publish, and communicate comprehensive information security policies and standards, collaboratively ensuring their enforceability and practicality based on frameworks like NIST and ISO 27001.
• Engage with Security and Engineering leadership to identify emerging security risks and devise policy-driven solutions.
• Analyze data behind technical controls, leveraging available tools including AI-assisted technologies, to generate real-time or periodic control effectiveness metrics that enhance program scalability and impact.
• Assist with internal and external audit processes in conjunction with cyber-Compliance teams.
• Maintain detailed documentation and dashboards illustrating control effectiveness and key performance indicators to facilitate ongoing program improvement.
• Implement, configure, and customize Governance, Risk, and Compliance (GRC) platform tools, integrating them with security and IT systems for efficient control mapping, evidence collection, and posture reporting.
• Collaborate regularly with Security, IT, Legal, and Engineering teams to address compliance challenges as they arise.

Candidate Qualifications

• At least eight years of experience in cybersecurity, IT governance, GRC, or related fields.
• Strong foundational knowledge of security frameworks such as NIST Cybersecurity Framework, ISO 27001, and CIS Controls.
• Proficiency in working with technical control data sources and transforming such data into meaningful metrics using tools including AI-driven solutions.
• Experience with cloud platforms (AWS, Azure, GCP), identity providers, and IT service management/ticketing tools like ServiceNow and Jira.
• Expertise in deploying and customizing GRC solutions like ServiceNow GRC, Archer, or OneTrust, beyond mere operational use of existing setups.
• Excellent organizational and communication abilities, facilitating engagement with diverse stakeholders across functions.
• Solid understanding of risk management and regulatory compliance principles relevant to enterprise cybersecurity programs.
• Bachelor's degree or equivalent qualification in Cybersecurity, Information Security, Risk Management, Audit, or a related discipline.
• Hands-on experience authoring, updating, and enforcing security policies, with an emphasis on practical control implementation.
• Familiarity with audit protocols and compliance mandates including SOC 2, ISO 27001, GDPR, and HIPAA.
• Background in performing risk assessments and control testing.
• Experience in GRC engineering or security data engineering, including development of control effectiveness monitoring and posture dashboards from technical systems.
• Basic scripting or querying skills (for example, in Python or SQL) to manipulate or automate control data workflows.
• Relevant industry certifications like Security+ or ISO 27001 Lead Implementer are advantageous but not mandatory.
• Knowledge of governance frameworks applicable to cloud-native, SaaS, or DevOps environments.

Additional Information

This role offers an excellent growth opportunity for security professionals eager to lead cybersecurity governance within an innovative and rapidly expanding technology company. Candidates will directly influence policy content, work alongside leadership to address real-time security challenges, and leverage cutting-edge tools, including artificial intelligence, to measure program effectiveness.

Data Privacy: Prospective candidates’ personal information will be handled according to the company’s Privacy Policy.

Equal Opportunity: Cohesity is an equal opportunity employer committed to diversity and inclusion, providing fair consideration to all qualified applicants without discrimination.

Accessibility: Applicants with disabilities requiring accommodations or alternative application methods may contact the company directly for assistance.

Work Location Expectations: Employees within a reasonable commute (approximately 45 minutes) are expected to work onsite at company offices two to three days per week, with flexible scheduling options. Preference is given to candidates currently residing near the Dublin area or those willing to relocate before starting, possessing legal work authorization.