Software Risk Manager

Software Risk Manager

Hybrid role in Lawrence, MA or San Francisco, CA area. Local candidates are preferred.

Software Risk Manager

Job Description:

• The Software Risk Manager is responsible for identifying, assessing, mitigating, and continuously monitoring risks associated with software development, deployment, integration, and operations.
• This role operates at the intersection of engineering, cybersecurity, compliance, product management, and enterprise risk to ensure software systems meet regulatory, security, operational, and business continuity standards.
• The position requires deep understanding of SDLC governance, third-party risk, secure architecture principles, and operational resilience frameworks.

Software Risk Governance

• Establish and maintain a formal software risk management framework aligned to enterprise risk standards.
• Define risk taxonomy specific to software engineering, DevOps, cloud architecture, AI/ML systems, and third-party integrations.
• Develop and enforce risk control policies across the SDLC.
• Maintain software risk register and risk heat maps.

Risk Identification & Assessment

Conduct risk assessments for:

• New software initiatives
• Major releases
• IoT connected devices
• Third-party software integrations
• Perform architecture risk reviews.
• Lead threat modeling exercises.
• Evaluate systemic, operational, security, and compliance risks.
• SDLC & DevSecOps Integration
• Embed risk controls within Agile, or DevOps workflows.
• Collaborate with engineering leadership to implement secure-by-design and privacy-by-design principles.
• Ensure code review, vulnerability scanning, and penetration testing processes are enforced.
• Validate CI/CD pipelines include appropriate risk gates.

Regulatory & Compliance Alignment

• Align software controls with relevant frameworks such as:
• Support internal and external audits.
• Maintain documentation for regulatory reviews.

Third-Party & Vendor Risk (not part of device scope, but for future)

• Assess software vendors and SaaS platforms for:
  • Security posture
  • Data protection controls
  • Operational resilience
  • Financial stability risk
• Coordinate due diligence reviews and ongoing monitoring.

Incident & Issue Management (this is closer to system risk and not needed for this role as we have a system risk manager)

• Participate in post-incident root cause analysis.
• Evaluate control breakdowns.
• Recommend systemic remediation actions.
• Track risk treatment plans to closure.