ZipRecruiter

Log In

1

Security Risk Management Jobs (NOW HIRING)

Affirm

Security Risk Management Lead

The Security Risk Management team is evolving beyond traditional governance, risk, and compliance; we are building an engineering driven program that designs, automates, and scales the controls ...

DLL

Security Risk Officer

Wayne, PA · Remote

This role will support GIS in ensuring that security risk management practices are uniformly and appropriately incorporated into DLL. Day to day: The Security Risk Officer fulfills the following ...

next page

Showing results 1-20

All JobsSecurity Risk Management Jobs

Security Risk Management information

See salary details

$10

$50

$69

How much do security risk management jobs pay per hour?

As of Jun 19, 2026, the average hourly pay for security risk management in the United States is $50.41, according to ZipRecruiter salary data. Most workers in this role earn between $40.87 and $60.10 per hour, depending on experience, location, and employer.

What are the typical challenges faced by professionals in Security Risk Management, and how can they be addressed?

Professionals in Security Risk Management often encounter challenges such as rapidly evolving threats, balancing security with business operations, and ensuring organization-wide compliance with regulations. Staying current with the latest risk trends and fostering cross-department collaboration are key strategies for overcoming these obstacles. Additionally, clear communication of risks to non-technical stakeholders and ongoing training are essential for building a proactive security culture and effective risk mitigation.

Can I make $200,000 a year in cyber security?

Security Risk Management professionals can potentially earn $200,000 or more annually, especially with extensive experience, advanced certifications like CISSP or CISM, and roles in high-demand industries or senior leadership positions. Salary levels vary based on location, company size, and individual expertise, but high-level cybersecurity roles often offer compensation in this range.

Can you make $500,000 a year in cyber security?

Security Risk Management professionals can potentially earn $500,000 or more annually, especially at senior levels, in leadership roles, or within large organizations. Achieving this income typically requires extensive experience, advanced certifications like CISSP or CISM, and expertise in high-demand areas such as threat intelligence or security architecture.

Is security risk management a good career?

Security risk management is a viable career that involves identifying, assessing, and mitigating security threats to organizations. It often requires certifications such as CISSP or CISM and skills in risk analysis, security policies, and incident response. The field offers opportunities across various industries with increasing demand for cybersecurity expertise.

What is Security Risk Management?

Security Risk Management is the process of identifying, assessing, and mitigating risks to an organization's information, assets, and operations. It involves evaluating potential threats and vulnerabilities, determining their potential impact, and implementing strategies to minimize or control these risks. The goal is to protect the organization from security breaches, data loss, and other threats while ensuring compliance with legal and regulatory requirements. Security Risk Management is essential for maintaining business continuity and safeguarding reputation.

What are the key skills and qualifications needed to thrive in Security Risk Management, and why are they important?

To excel in Security Risk Management, you need a solid understanding of risk assessment frameworks, cybersecurity principles, and compliance standards, often supported by a degree in information security or related fields. Familiarity with risk management tools, security incident response systems, and certifications such as CISSP or CISM is typically required. Strong analytical thinking, communication, and decision-making skills help professionals navigate complex threats and collaborate across departments. These competencies are crucial for effectively identifying, mitigating, and communicating risks to protect organizational assets and ensure regulatory compliance.

What is the difference between Security Risk Management vs Security Analyst?

AspectSecurity Risk ManagementSecurity Analyst
CertificationsCRISC, CISSP, CISMCompTIA Security+, CISSP, CEH
Work EnvironmentStrategic, policy-focused, risk assessmentOperational, monitoring, incident response
Employer & Industry UsageOrganizations managing enterprise security risksSecurity teams, cybersecurity firms, IT departments

Security Risk Management focuses on identifying, assessing, and mitigating security risks at an organizational level, often involving policy development and strategic planning. In contrast, Security Analysts primarily monitor security systems, analyze threats, and respond to incidents. Both roles are essential but differ in scope and responsibilities within the cybersecurity field.

Is SOC 1 entry level?

SOC 1 (Service Organization Control 1) reports are audit reports used to evaluate internal controls at a service organization and are not job roles. In the context of security risk management, entry-level positions typically require foundational knowledge of security principles, certifications like CompTIA Security+ or CISSP, and experience with risk assessment tools, but SOC 1 itself is not an entry-level role.
More about Security Risk Management jobs
What cities are hiring for Security Risk Management jobs? Cities with the most Security Risk Management job openings:
What states have the most Security Risk Management jobs? States with the most job openings for Security Risk Management jobs include:
What job categories do people searching Security Risk Management jobs look for? The top searched job categories for Security Risk Management jobs are:
Security Risk Management jobs near you
Infographic showing various Security Risk Management job openings in the United States as of June 2026, with employment types broken down into 3% As Needed, 91% Full Time, and 6% Part Time. Highlights an 92% Physical, 2% Hybrid, and 6% Remote job distribution, with an average salary of $104,848 per year, or $50.4 per hour.
Director, Security Risk Management

Director, Security Risk Management

CardWorks

Long Island, ME • On-site

Full-time

Medical, Dental, Vision, Life, Retirement, PTO

Posted 9 days ago

CardWorks rating

9.1

Company rating: 9.1 out of 10

Based on 8 frontline employees who took The Breakroom Quiz

1st of 17 rated payment service providers

Job description

Become an everyday champion - and build a career where your impact fuels financial progress.


What We Do

CardWorks Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle. Through our family of companies, CardWorks Financial Group tackles the complex challenges that larger financial institutions leave behind. We're embedded throughout the credit card ecosystem as a lender, servicer, and merchant acquirer.

Who We Are

  • Merrick Bank: The bank that builds
  • CardWorks Servicing: One partner, total performance
  • Carson Smithfield: Resolution with respect

With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery. The CardWorks Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer.

Our team tackles the industry's most complex credit and payment challenges. And we believe that excellent work starts with a team that feels supported, respected, and empowered to grow.

CardWorks Servicing, LLC provides end-to end operational servicing functions for credit cards, secured cards, and installment loans. We service consumer and small business loans across the credit spectrum and offers backup servicing and due diligence services to capital providers and trustees.


Founded in 1997, Merrick Bank is an FDIC-insured financial institution headquartered in South Jordan, Utah, with over $10 billion in assets. A wholly owned subsidiary of CardWorks Financial Group, Merrick Bank serves roughly five million cardmembers and more than 100,000 merchant customers, offering credit cards, recreational loans, deposit accounts, merchant services and bank sponsorships to consumers and businesses.

Carson Smithfield, LLC provides a variety of post-charge-off debt recovery services, including digital self-service, IVR, live agent, and external agency management.

Position Summary:

The Information Security Risk Management Director is responsible for leading the design, implementation, and oversight of the organization's information security risk management and vendor security assessment programs. This is a hands-on leadership role that develops and ensures that cyber risk identification, assessment, mitigation, and reporting activities are consistently executed and centrally managed within the organization's risk management framework and tools.


The Director oversees and performs information security risk assessments across internal systems, business processes, third-party vendors, and enterprise projects to ensure risks are effectively identified, rated, and managed in alignment with Enterprise Risk Management practices and regulatory frameworks such as the Cyber Risk Institute (CRI) Profile, NIST Cybersecurity Framework (CSF), and PCI DSS.


By integrating security risk management practices with business and technology initiatives, the Director drives informed decision-making, strengthens the organization's security posture, enhances compliance with policies and standards, and promotes a culture of proactive security risk management across the enterprise.

Essential Functions:

Leadership and Program Oversight

  • Lead, mature, and operationalize the organization's information security risk management and vendor security assessment programs.
  • Provide strategic and hands-on leadership for a small team and/or third-party resources responsible for executing assessments, managing risk registers, and maintaining program processes.
  • Develop and maintain consistent methodologies, templates, and workflows for risk assessments and vendor reviews.
  • Partner with Enterprise Risk Management to ensure cybersecurity risks are integrated into enterprise risk registers, prioritized appropriately, and aligned with enterprise issue management and escalation processes.
  • Risk Assessment and Governance
  • Oversee and perform security risk assessments for applications, infrastructure, and business processes to identify threats, vulnerabilities, control weaknesses, and business impacts.
  • Mature risk scoring methodologies to prioritize risks based on likelihood and business impact.
  • Identify opportunities to streamline assessment workflows, automate evidence collection, and enhance tool integration across GRC, IT, and security systems.

Vendor and Third-Party Security Risk

  • Lead vendor security reviews, evaluating SOC 2 reports, ISO 27001 certifications, PCI AOCs, and penetration test results to assess vendor control maturity.
  • Collaborate with Procurement, Legal, and Third-Party Risk Management (TPRM) teams to embed security requirements into contracts, onboarding, and ongoing vendor oversight.
  • Track and manage vendor-related security issues, ensuring timely remediation, escalation, and closure consistent with SLAs and enterprise issue management processes.
  • Develop and maintain vendor risk dashboards and KRIs to provide visibility into supply-chain risk exposure and remediation progress.

Reporting and Continuous Improvement

  • Define, track, and report cybersecurity risk metrics, dashboards, and assessment outcomes for senior leadership.
  • Ensure data quality, consistency, evidence integrity, and traceability across GRC platforms and supporting tools
  • Drive program improvements through automation, analytics, risk trend analysis, and lessons learned from incidents, audits, and assessments.
  • Promote a culture of transparency, accountability, and proactive cyber risk management throughout the organization.

Education and Experience

  • 8+ years of experience in information security, security risk management, compliance, or related fields within a regulated or technology-driven environment, including 3+ years in a leadership or program management capacity.
  • Demonstrated experience in assessing, mitigating, and tracking security risks across systems, infrastructure, and third-party vendors, with proven success in driving remediation and program maturity.
  • Strong understanding of information security risk frameworks and methodologies, including the Cyber Risk Institute (CRI) Profile, NIST Cybersecurity Framework (CSF), CIS-CSC, and PCI DSS, with hands-on experience applying these standards to projects, systems, and infrastructure.
  • Experience developing or enhancing risk management processes, including risk and control matrix development, risk scoring models, control evaluation criteria, and integrating governance workflows with enterprise risk management (ERM) practices.

  • Proven ability to collaborate across diverse stakeholders, including IT, Enterprise Risk Management, Legal, Compliance, business units, and external partners, to embed security requirements, align with project objectives, and inform decision-making.

  • Familiarity with GRC or security compliance platforms (e.g. Archer, ServiceNow, Auditboard) and reporting mechanisms for documenting and tracking risk, remediation, and control testing results.
  • Bachelor's or master's degree in information security, Information Technology, Risk Management, or a related field preferred.
  • Preferred certifications: CRISC, CISM, CISSP, or CISA.

Summary of Qualifications:

  • Strategic and hands-on cybersecurity risk leader with a proven ability to design, implement, and mature enterprise-wide risk management programs.
  • Deep understanding of information security risk frameworks (NIST CSF, CRI Profile, PCI DSS, CIS Controls, etc.) and enterprise risk management principles, with practical experience applying them across systems, processes, and third-party vendors.
  • Demonstrated success in leading and mentoring small teams, fostering capability growth, and scaling risk management functions to meet enterprise needs.
  • Strong analytical and problem-solving skills, adept at evaluating threats, assessing process and control effectiveness, addressing gaps, and translating risks into business-relevant insights.
  • Skilled at delivering on and coordinating multiple efforts across IT, business, compliance, and ERM teams, influencing decisions, and driving risk-informed outcomes while maintaining accountability and transparency.
  • Excellent communication and interpersonal skills (via email, chat, in-person, and virtual) to engage effectively with technical teams, executives, and non-technical stakeholders.
  • High level of attention to detail and organization, ensuring accurate, timely, and complete documentation and reporting.

  • Recognized as a trusted advisor and credible authority, capable of balancing strategic oversight with hands-on execution in a dynamic and evolving environment.

  • Self-motivated and collaborative, with a strong commitment to continuous improvement, accountability, operational excellence, and promoting a culture of proactive security risk management across the organization.

Ideally, the qualified candidate will work at the following location(s): Woodbury, NY; South Jordan, UT; Horsham, PA; Pittsburgh, PA; Orlando, FL. A hybrid work model or fully remote model can be considered based on hiring manager decision and priorities of the role.

The salary range for this position, if located in NY Metro/NY State is $151,165 to $167,961. However, please note that the salary range will vary for other geographic areas.

#INDHP

Our Employee Value Proposition

  • Competitive Pay, including a Bonus Target or Variable Pay Incentive Program
  • Benefits Package -Medical, Dental, and Vision (plus much more)
  • 401(k) Plan with Company Match
  • Short- & Long-Term Disability
  • Wellness Programs
  • Group Life and AD&D Insurance
  • Paid Vacation, Sick Days and bank Holidays
  • Employee Engagement Activities including Employee Appreciation Day, DEI Employee Resource Groups, Corporate Social Responsibility, Service Recognition

We offer a total rewards package comprised of a competitive base rate of pay, variable pay incentive programs based on the role, and a comprehensive benefit suite. Offered rates of pay are determined based on job-related knowledge, relevant experience, skills, certifications, and geographic location.


We are proud to be an equal opportunity employer. All qualified applicants will receive consideration without regard to age, race, color, sex, or gender identity/expression (including pregnancy, childbirth, transgender status, or sexual orientation), religion or creed, ancestry, citizenship, national origin, disability, military or veteran status, marital status, genetic information, or any other characteristic protected by applicable law.

We do not tolerate discrimination, harassment, or retaliation. Employment decisions are based solely on qualifications, merit, and business needs. Everyone is welcome here, and we hire based on your ability to do the job, not any protected characteristics.

If you need help or reasonable accommodation during the application or hiring process, please let your TA Partner know.


Apply