Technical Risk Manager - Sr. Security Engineer I

Smartsheet is hiring a Senior Security Engineer I to own and mature its Security Risk Management program, including risk identification, analysis, quantification, and enterprise risk register management. The role also oversees Third-Party Risk Management and translates technical risks into mitigation strategies and reporting that support leadership decisions.

Responsibilities:

• Own and mature Smartsheet's Security Risk Management program: risk identification, analysis, scoring, and quantification (e.g., FAIR-based or similar) across internal systems, third parties, and emerging initiatives
• Maintain the enterprise risk register—ratings, ownership, mitigation status, and residual risk—and drive it toward a living, decision-useful tool rather than a static spreadsheet
• Lead risk analysis and reviews for new initiatives, architecture changes, and significant findings, translating technical exposure into business-relevant risk statements for leadership
• Develop and drive risk mitigation strategy: work with risk owners across engineering, IT, and business teams to define remediation plans, track them to closure, and escalate what isn't moving
• Oversee Smartsheet's Third-Party Risk Management (TPRM) program: vendor risk tiering, security assessment/questionnaire review, ongoing monitoring, and issue tracking for the vendor and partner ecosystem
• Build and present risk reporting and KPIs/KRIs to security and business leadership, giving them a clear view of top enterprise risks and where mitigation investment should go
• Partner with GRC, Field Security Engineering, and engineering leads to make sure risk findings from audits, pen tests, and questionnaires feed back into the same risk register and prioritization process

Requirements:

• 4+ years of experience in security risk management, enterprise risk, or GRC, including direct ownership of a risk register and risk assessment process
• Working familiarity with risk quantification approaches (FAIR, OCTAVE, or similar) and the judgment to apply them practically rather than academically
• Enough technical fluency to understand cloud architecture, application security concepts, and common vulnerability/risk findings well enough to discuss them credibly with engineering teams—deep hands-on engineering experience is not required
• Experience running or closely supporting a Third-Party Risk Management program: vendor tiering, questionnaire review, and ongoing monitoring
• Excellent written and verbal communication skills; you can brief a risk finding to an engineering lead and to an executive and have both walk away with the right takeaway
• Strong organizational skills and comfort managing many concurrent risk items and vendor relationships without losing track of status
• Legally eligible to work in the U.S. on an ongoing basis
• Professional certifications: CRISC, CISSP, CISM, or equivalent
• Experience with GRC or TPRM tooling (Vanta, Drata, OneTrust, Archer, ServiceNow GRC, or similar)
• Background supporting SOC 2, ISO 27001, or FedRAMP programs and an understanding of how risk management ties into those certifications
• Experience presenting risk posture to senior leadership or board-level audiences