Software Risk Manager – Hybrid role in Lawrence, MA or San Francisco, CA area. Local candidates are preferred.
Contract
Software Risk Manager Job Description:
The Software Risk Manager is responsible for identifying, assessing, mitigating, and continuously monitoring risks associated with software development, deployment, integration, and operations. This role operates at the intersection of engineering, cybersecurity, compliance, product management, and enterprise risk to ensure software systems meet regulatory, security, operational, and business continuity standards.
The position requires deep understanding of SDLC governance, third-party risk, secure architecture principles, and operational resilience frameworks.
Software Risk Governance
Establish and maintain a formal software risk management framework aligned to enterprise risk standards.
Define risk taxonomy specific to software engineering, DevOps, cloud architecture, AI/ML systems, and third-party integrations.
Develop and enforce risk control policies across the SDLC.
Maintain software risk register and risk heat maps.
Risk Identification & Assessment
Conduct risk assessments for:
New software initiatives
Major releases
IoT connected devices
Third-party software integrations
Perform architecture risk reviews.
Lead threat modeling exercises.
Evaluate systemic, operational, security, and compliance risks.
SDLC & DevSecOps Integration
Embed risk controls within Agile, or DevOps workflows.
Collaborate with engineering leadership to implement secure-by-design and privacy-by-design principles.
Ensure code review, vulnerability scanning, and penetration testing processes are enforced.
Validate CI/CD pipelines include appropriate risk gates.
Regulatory & Compliance Alignment
- Align software controls with relevant frameworks such as:
- Support internal and external audits.
- Maintain documentation for regulatory reviews.
Third-Party & Vendor Risk (not part of device scope, but for future)
- Assess software vendors and SaaS platforms for:
- Security posture
- Data protection controls
- Operational resilience
- Financial stability risk
- Coordinate due diligence reviews and ongoing monitoring.
Incident & Issue Management (this is closer to system risk and not needed for this role as we have a system risk manager)
- Participate in post-incident root cause analysis.
- Evaluate control breakdowns.
- Recommend systemic remediation actions.
- Track risk treatment plans to closure.
|
Neha Chaudhary |
