Manager of Security Risk Management

Costco IT is responsible for the technical future of Costco Wholesale, the third largest retailer in the world with wholesale operations in fourteen countries. Despite our size and explosive international expansion, we continue to provide a family, employee centric atmosphere in which our employees thrive and succeed. 

This is an environment unlike anything in the high-tech world and the secret of Costco’s success is its culture. The value Costco puts on its employees is well documented in articles from a variety of publishers including Bloomberg and Forbes. Our employees and our members come FIRST.  Costco is well known for its generosity and community service and has won many awards for its philanthropy. The company joins with its employees to take an active role in volunteering by sponsoring many opportunities to help others. 

Come join the Costco Wholesale IT family. Costco IT is a dynamic, fast-paced environment, working through exciting transformation efforts. We are building the next generation retail environment where you will be surrounded by dedicated and highly professional employees.

As a member of the IT Management Team, you are responsible for managing, developing, and leading a team of employees. Your role includes leading the specific functional responsibilities of your team, which involves overseeing team performance and deliverables. However, your role as a leader within our organization requires more than the management of resources and day-to-day operations. As a steward of the company, you are charged with the development and execution of your team’s strategic vision and plan and ensuring that your team’s actions align with the larger goals of the company and the IT Division.

We are seeking a dynamic and experienced Manager of Security Risk Management to join our Security Risk and compliance team. This role will be pivotal in setting and implementing our risk management strategy, including overseeing the identification and assessment of security risks, the design and implementation of automated risk and control assessment processes, and managing a centralized risk register and reporting that drives decision making.

As a key leader, you will build and manage a small, highly skilled team, driving innovation in security risk management calibrations and operations, and will work closely with security teams, privacy experts, legal, and other IT and business leaders to provide actionable insights and drive risk based decision making across the organization. 

As the primary conduit between your employees and upper leadership, your role in communicating and modeling the values and guiding principles of our company culture is of vital importance. All members of IT Management should strive to consciously and consistently foster a culture of engagement, trust, and “open door” communication. 

If you want to be a part of one of the worldwideBEST companies “to work for”, simply apply and let your career be reimagined.

ROLE

• INTEGRITY: When achieving benchmarks and goals, use methods/strategies that are consistent with the Code of Ethics and the Standard of Ethics for Managers and Supervisors. Always leads by example. Appropriately handles employee concerns and follows through to resolution.

• MEMBER SERVICE: Provides and ensures staff provides an exceptional member experience.

• ADMINISTRATION: Ensures proper department coverage (writing schedule and break aids if needed). Understands department budget, able to research and explain budget variances.

• MANAGING PERFORMANCE:Coaches and mentors employees to provide support and guidance. Has regular open and honest conversations with employees to discuss work performance and career development. Identifies learning opportunities to strengthen employee knowledge, skill and ability.

• COMMUNICATION:Regularly shares information with employees via meetings and one-on-one conversations. Successfully navigates difficult conversations with employees, members, and suppliers. Listens, expresses empathy and adapts to get points across. Addresses issues immediately to ensure a timely resolution and to avoid escalating the situation. Consistently demonstrates business knowledge during interactions with senior management.

• SELF-MANAGEMENT:Demonstrates sound judgment, taking a partner when necessary. Ability to maintain self-control in the face of hostility or provocation or in intense, hectic situations.

• INCLUSION: Encourages different approaches and ideas to work and to accomplish goals. Seeks employee input. Takes the time to get to know or reach out to candidates who show potential that may not come forward on their own.

• COMPLIANCE AND SAFETY: Takes measures to ensure employee and member information is kept confidential and adheres to IS security policy.

• LEADERSHIP & TEAM DEVELOPMENT: Build and lead a high-performing team of security risk professionals, provide coaching and career development opportunities to team members, and foster a collaborative and innovative environment.

• RISK MANAGEMENT STRATEGY & OPERATIONS: Develop, implement, and maintain a comprehensive security risk management strategy, and its ongoing operations to identify, assess, and prioritize security risks to the organization.

• AUTOMATED RISK & CONTROL VALIDATIONS:Lead the identification and implementation of solutions to automate risk and control assessments.

• COMMUNICATION & REPORTING: Develop and maintain centralized risk register and reporting mechanisms for security risk management to ensure transparency and accountability, and collaborate with other departments to communicate risk trends and mitigation strategies.

• MEASURE & REPORT PROGRAM EFFECTIVENESS: Define appropriate KPIs and measures for team success; provide leadership with periodic reporting on results and impact

• This is a full-time management/leadership position (45+ hours per week).

  Ability to operate vehicles, equipment or machinery.

• Computer, phone, printer, copier, fax

REQUIRED

• 8+ years of experience in security/compliance risk management, technology audit or related fields.

• At least 3 years experience leading security, compliance or risk teams in a management or supervisory role preferred. 

• Strong understanding of Information Security and Security Governance, Risk and Compliance frameworks, methodologies, and practices.

• Technical security and architecture knowledge with the ability to recognize, analyze and troubleshoot issues, and articulate those to both technical and non-technical audiences

• Strong leadership and team management skills, with a demonstrated ability to lead cross-functional teams and drive organizational change

• Superb communication and relationships skills, especially the ability to understand and articulate advanced technical topics to non-technical audiences and build consensus among partners and leadership.

• Serves as subject matter expert for enterprise security risk assessments, risk response, and risk management programs.

• Aggregates and analyzes risk signals from vulnerability management, threat intelligence, cloud security, third party risks and other security domains to inform risk decisions and priorities.

• Researches and monitors emerging risks associated with new technologies such as Artificial Intelligence (AI), implementations, and configurations, applying industry best practices to reduce organizational exposure.

• Understands regulatory and compliance requirements that impact security and collaborates with business and project teams to develop risk-appropriate solutions, including supporting audit activities.

• Presents risk posture, technical findings, and recommendations to executives, management, and cross-functional audiences to build consensus and drive decisions.

• Leverages AI-powered tools to enhance risk identification, prioritization, and reporting workflows, identifying opportunities to responsibly automate risk processes.

• Automates, documents, educates, and delegates risk processes to improve efficiency and scalability across the team.

• HIPAA Training and Supervisors Orientation (within 30 days of hire); Leadership Development 101 (within one year); Costco Pay Policies (within 90 days of promotion).

Recommended

• Bachelor’s degree in Information Technology, Artificial Intelligence, Cybersecurity, Risk Management, or related field

• Relevant certifications such as CISSP, CISM, or CRISC 

• Proficient in Google Workspace applications, including Sheets, Docs, Slides, and Gmail.

Required Documents

●      Cover Letter

●      Resume

California applicants, please click here to review the Costco Applicant Privacy Notice.

Pay Range: $137,000 - $210,000, Bonus and Restricted Stock Unit (RSU) eligible

We offer a comprehensive package of benefits including paid time off, health benefits - medical/dental/vision/hearing aid/pharmacy/behavioral health/employee assistance, health care reimbursement account, dependent care assistance plan, short-term disability and long-term disability insurance, AD&D insurance, life insurance, 401(k), stock purchase plan to eligible employees.

Costco is committed to a diverse and inclusive workplace. Costco is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or any other legally protected status. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [email protected]

If hired, you will be required to provide proof of authorization to work in the United States. Applicants and employees for this position will not be sponsored for work authorization, including, but not limited to H1-B visas.