Director, Governance, Risk & Compliance

Company Description: Anomali, headquartered in Silicon Valley, delivers the first Intelligence-Native Agentic SOC Platform — unifying a security data lake, the world's largest IOC repository, threat intelligence, and agentic AI into a single modern experience. The platform accelerates detection, investigation, and response, delivering earlier insights, faster action, and scalable modernization across any environment. Whether augmenting existing tools or delivering complete SOC capabilities end-to-end, Anomali empowers security teams to operate faster, smarter, and with confidence. Beyond Detecting. Start Deciding. Start Acting. Learn more at www.anomali.com   Position Overview:   Anomali is scaling its compliance program to support an AI-native cybersecurity platform used by governments and enterprises worldwide. We're looking for a hands-on GRC leader who can own and drive our multi-jurisdiction certification portfolio — spanning U.S. federal (FedRAMP), global (ISO 27001, SOC 2), and regional cloud security frameworks (UAE DESC, Saudi Arabia NCA/CCC, Australia IRAP) — while building the scalable compliance infrastructure to support continued international expansion. This is a builder role, not a maintainer role. You'll be the single point of accountability for keeping our certifications current, audit-ready, and strategically sequenced to unlock new markets and revenue. Key Responsibilities:   Program Ownership & Strategy Own the end-to-end GRC roadmap across FedRAMP, ISO 27001, SOC 2, DESC (Dubai Electronic Security Center), Saudi NCA Cloud Cybersecurity Controls (CCC), Australia IRAP, and other regional cloud security/data residency frameworks as they arise Prioritize and sequence certification efforts against GTM and revenue targets, in partnership with sales, product, and executive leadership Serve as the primary liaison with assessors, auditors, and regulatory bodies (3PAOs, sponsoring agencies, in-country assessors) FedRAMP Manage ongoing FedRAMP authorization activities (ATO maintenance, continuous monitoring, SAR/POA&M remediation) in partnership with the 3PAO and sponsoring agency Own documentation quality (SSP, SAR, POA&M) and escalation management when assessor deliverables fall short ISO 27001 Maintain and evolve the ISMS, manage internal/external audit cycles, and drive continuous improvement of controls, risk assessments, and policy frameworks SOC 2 Own SOC 2 Type II audit readiness and execution (Security, Availability, and Confidentiality trust services criteria) in partnership with the external audit firm Manage evidence collection, control testing, and remediation of exceptions across annual audit cycles Ensure alignment between SOC 2 controls and overlapping ISO 27001/FedRAMP requirements to avoid duplicated audit effort Regional Cloud/Government Certifications Drive DESC CSP certification for UAE market access. The CSP Security Standard is based on the following international standards, which the candidate should be conversant in: ISO/IEC 27001:2013ISO/IEC 27002:2013ISO/IEC 27017:2015ISR:2017 v.02CSA Cloud Controls Matrix 3.0.1 Manage Saudi NCA compliance (ECC/CCC) in coordination with local partners Own Australia IRAP assessment process and coordination with registered assessors Monitor emerging regional requirements (e.g., additional Gulf, APAC, or EU frameworks) and advise on prioritization Risk & Controls Build and maintain a unified controls framework that maps overlapping requirements across all frameworks to avoid duplicated effort Own enterprise risk register, vendor/third-party risk management, and remediation tracking Partner with engineering and product teams to ensure security controls are designed in, not bolted on Cross-Functional Leadership Partner with internal cross-functional teams — IT, Security, Cloud Infrastructure, Engineering, and Product — to own and drive compliance outcomes end-to-end Support customer/prospect due diligence (security questionnaires, audit requests,