Director; Governance, Risk & Compliance

Summary:Cosm is building its information security program, and this role owns the governance backbone. We operate immersive venues, produce and handle premium content under studio and Trusted Partner Network security requirements, and we are building toward the control maturity that comes with rapid growth and external scrutiny. That combination means regulatory exposure and audit scrutiny from partners who take content security seriously.Reporting to the Information Security Officer, you will own the risk register and the appetite framework behind it, independent verification of controls that Engineering, Security Engineering, and IT build and operate, the control catalog and evidence program supporting NIST CSF 2.0, SOX ITGC, and TPN, third-party risk across the vendor lifecycle, security policy and awareness, and the metrics and reporting that senior leadership relies on to make risk acceptance decisions.Independence is the point of the role. You will assure controls you did not build, audit technical standards written by the engineers who own them, and tell senior stakeholders when residual risk exceeds what the business has agreed to carry. That takes someone who can hold that line with credibility rather than authority.This is a build role, not a maintenance one. You will stand the function up from the ground, and grow it into a team as the program matures.Responsibilities:Enterprise cyber riskOperate and mature the risk register from initial population to a sustained program: scoring methodology, business impact analysis, and treatment-versus-acceptance decisions tracked to closure with named owners. Facilitate the executive risk review cycle, surfacing residual risks that exceed appetite. Maintain the risk appetite framework so that scoring, escalation thresholds, and "exceeds appetite" triggers stay aligned to what the Audit Committee has approved, and support its annual review.Independent assuranceVerify that controls built and operated by Engineering, Security Engineering, and IT are designed correctly and working, maintaining separation between those who build controls and those who assure them. This includes auditing technical standards authored by Security Engineering, such as firewall and hardening baselines, against policy and framework requirements. Own the control evidence program in Vanta: every control with an assigned owner and defined evidence, collected on cadence, with coverage and freshness monitored and gaps closed ahead of audits. Track control deficiencies to remediation and report residual exposure to leadership.Compliance and audit readinessNIST CSF 2.0, SOX ITGC, and TPN. Plan and run internal audits, perform and document control testing, support external assessments, and lead customer and partner security due diligence.Third-party riskOwn the vendor security program end to end: intake, security review, risk rating, attestation collection, and ongoing monitoring across the vendor lifecycle. Partner with Legal and Procurement to get security requirements into onboarding and contracts.Policy and control frameworkAuthor and maintain security policies, and drive them through ratification, distribution, and tracked acknowledgment where they bind individuals, including contractors before access is granted. Manage the control catalog that maps Cosm's controls to its frameworks, and coordinate control ownership across the organization. Technical standards are authored by Security Engineering; you review them for policy alignment and audit against them.Security awarenessOwn the awareness and role-based training program end to end: content, cadence, delivery, phishing simulation, completion tracking, and role-specific training for administrators, privileged users, and developers.Board reporting and metricsDesign the metrics framework, KPIs and KRIs tied to risk appetite rather than activity volume. Define the escalation triggers that force an off-cycle report to the Audit Committee, such as a critical vulnerability past its SLA or a control failure in a high-criticality area. Produce the quarterly Audit Committee package: maturity movement with rationale, top gaps with owners and dates, incidents mapped to previously identified gaps, and resourcing tied to specific exposures. Present to senior leadership, the Cybersecurity Executive Steering Committee, and the Audit Committee.Incident supportProvide risk, control, and impact context to the decision-makers assessing whether an incident is material, and own the control and maturity findings that come out of post-incident review.Experience:

8 to 12 years in IT governance, risk, and compliance, including leading GRC programs or major initiatives in enterprise environmentsHands-on experience operating and maturing risk registers, running risk assessments, gap analyses, and business impact analyses, and driving treatment decisions to closureIndependent control testing experience supporting SOX ITGCExperience planning and executing internal auditsExperience owning a third-party risk program, including review of vendor security attestationsExperience running continuous-compliance and evidence collection in a GRC platform. We use VantaExpertise authoring IT and security policies that meet regulatory requirements, and running them through review, ratification, and acknowledgmentTrack record producing board or audit-committee-level reporting on maturity, risk posture, and remediation, and designing metrics tied to risk appetiteExperience building training and awareness programsDeep working knowledge of NIST CSF 2.0 and 800-53; familiarity with SOC 2, ISO 27001, COBIT, and CIS ControlsAbility to explain complex risk to non-technical senior stakeholders and influence decisionsBachelor's degree in a related field, or equivalent experience

Helpful, not required: content, media, or entertainment security experience including TPN; certifications such as CISM, CRISC, CISA, CGEIT, or CISSP.The annualized salary range for this position in California is $210,000 to $225,000. The base pay offered will factor in internal equity and may also vary depending on the candidate's geographic region, job-related knowledge, skills, and relevant experience, among other factors