Technical Risk Manager - Sr. Security Engineer I

Role

Smartsheet is seeking a Technical Risk Manager / Sr. Security Engineer I to own its Security Risk Management program and oversee Third-Party Risk Management (TPRM). The role translates technical exposure into business-relevant risk assessments and actionable mitigation priorities. Deep hands-on security engineering experience is not required.

This position reports to the Senior Director, GRC Engineering and may be based in Bellevue, WA, or remotely anywhere in the US where Smartsheet is a registered employer.

Responsibilities

• Own and mature security risk identification, analysis, scoring, and quantification across internal systems, third parties, and emerging initiatives, using FAIR-based or similar approaches.
• Maintain the enterprise risk register, including ratings, ownership, mitigation status, and residual risk, as a practical decision-making tool.
• Lead risk reviews for new initiatives, architecture changes, and significant findings; translate technical exposure into business-relevant risk statements.
• Work with engineering, IT, and business risk owners to develop remediation plans, track them to closure, and escalate stalled mitigation efforts.
• Oversee vendor risk tiering, security assessments and questionnaire reviews, ongoing monitoring, and issue tracking for the TPRM program.
• Present risk reporting and KPIs/KRIs to security and business leadership to guide mitigation investment.
• Partner with GRC, Field Security Engineering, and engineering leads to incorporate findings from audits, penetration tests, and questionnaires into the risk register and prioritization process.

Qualifications

• At least 4 years of experience in security risk management, enterprise risk, or GRC, including direct ownership of a risk register and risk assessment process.
• Working familiarity with FAIR, OCTAVE, or similar risk quantification approaches and judgment in applying them practically.
• Technical fluency in cloud architecture, application security concepts, and common vulnerability and risk findings sufficient to discuss exposure with engineering teams.
• Experience running or closely supporting a TPRM program, including vendor tiering, questionnaire review, and ongoing monitoring.
• Excellent written and verbal communication skills, including the ability to explain risk findings to engineering leads and executives.
• Strong organizational skills and ability to manage concurrent risk items and vendor relationships.
• Professional certification such as CRISC, CISSP, CISM, or equivalent.
• Experience with GRC or TPRM tooling such as Vanta, Drata, OneTrust, Archer, or ServiceNow GRC.
• Background supporting SOC 2, ISO 27001, or FedRAMP programs and understanding how risk management supports those programs.
• Experience presenting risk posture to senior leadership or board-level audiences.
• Ongoing legal eligibility to work in the US.

Compensation and Benefits

• Annual US base salary range: $145,000–$193,750 USD. Actual compensation depends on experience, skills, and location.
• Eligible for a market-competitive incentive opportunity.
• Employer-subsidized medical, vision, and dental coverage for full-time employees.
• 401(k) match of 50% of contributions up to the first 6% of eligible pay.
• Monthly work and productivity stipend.
• Flexible Time Away, sick time, and 12 paid holidays annually.
• Company-sponsored life insurance and short- and long-term disability coverage.
• Up to 24 weeks of parental leave and a paid volunteer day.
• Professional development opportunities, including Udemy courses.
• Company-funded perks including a counseling membership, local retail discounts, and a personal Smartsheet account.

Interview Accommodations

Candidates may request preparations to support a comfortable and positive interview experience.