Wood Mackenzie is the global data and analytics business for the renewables, energy, and natural resources industries. Enhanced by technology. Enriched by human intelligence. In an ever-changing world, companies and governments need reliable and actionable insight to lead the transition to a sustainable future. That’s why we cover the entire supply chain with unparalleled breadth and depth, backed by over 50 years’ experience. Our team of over 2,400 experts, operating across 30 global locations, are enabling customers’ decisions through real-time analytics, consultancy, events and thought leadership. Together, we deliver the insight they need to separate risk from opportunity and make confident decisions when it matters most.<a href="https://www.woodmac.com/">WoodMac.com</a><a href="https://www.youtube.com/watch?v=Y4AVwhQJj_w&amp;t=10s">Wood Mackenzie Brand Video</a>Wood Mackenzie Values<ul><li>Inclusive – we succeed together</li><li>Trusting – we choose to trust each other</li><li>Customer committed – we put customers at the heart of our decisions</li><li>Future Focused – we accelerate change</li><li>Curious – we turn knowledge into action</li></ul>We are seeking a highly skilled Senior Cyber Security Risk Manager to join our global Cyber Security team. This individual will play a critical role in maturing our Governance, Risk, and Compliance (GRC) function, ensuring alignment with leading frameworks (NIST CSF, NIST 800-53, SOC 2) and maintaining readiness for external audits and regulatory requirements.As a senior member of the team, you will be directly responsible for the organization’s risk management strategy, including oversight of the enterprise risk register, execution of internal audits, and governance of our risk exception process (PERA). This role requires a blend of technical expertise, strong analytical skills, and the ability to engage effectively with stakeholders across IT, procurement, and business leadership.<h3>Key Responsibilities</h3><ul><li>Lead the cybersecurity risk management program, including maintaining and continuously improving the enterprise risk register.</li><li>Own and manage the Policy Exception Risk Acceptance (PERA) process, ensuring risks are reviewed, tracked, and formally accepted or remediated.</li><li>Drive SOC 2 readiness activities across multiple business units, coordinating with auditors and internal stakeholders to ensure successful certification and renewals.</li><li>Oversee internal audit planning and execution, ensuring annual audit plans are risk-based, comprehensive, and aligned with organizational objectives.</li><li>Develop and enforce cybersecurity governance policies, standards, and procedures aligned to NIST CSF, NIST 800-53, and SOC 2 requirements.</li><li>Partner with IT, SRE, Architecture, and Procurement teams to identify, assess, and mitigate technology, third-party, and compliance risks.</li><li>Provide clear, data-driven reporting and metrics to the Head of Cyber Security and CIO on risk trends, audit findings, and remediation progress.</li><li>Monitor the external threat and regulatory landscape to ensure emerging risks are factored into the risk management strategy.</li><li>Act as a trusted advisor to business leaders on cybersecurity risk, providing practical guidance that balances security with business objectives.</li></ul><h3></h3><h3>Requirements</h3><ul><li>5+ years of hands-on experience in a dedicated cybersecurity risk management, GRC, or equivalent senior role.</li><li>Proven experience leading risk management programs and working with frameworks such as NIST CSF, NIST 800-53, and SOC 2.</li><li>Strong knowledge of risk registers, audit programs, and exception management processes.</li><li>Experience in SOC 2 audit readiness and execution, with ability to engage directly with auditors and control owners.</li><li>Demonstrated ability to engage and influence senior stakeholders, translating complex technical risk into business terms.</li><li>Strong analytical skills, with ability to interpret data, assess trends, and make evidence-based decisions.</li><li>Excellent written and verbal communication skills, including the ability to prepare board-level risk reporting.</li></ul><h3></h3><h3>Preferred Attributes</h3><ul><li>SaaS or technology sector experience.</li><li>Familiarity with enterprise GRC tools (e.g., ServiceNow, Archer, or Purview Compliance Manager).</li><li>Experience supporting third-party risk management activities.</li></ul>Equal OpportunitiesWe are an equal opportunities employer. This means we are committed to recruiting the best people regardless of their race, colour, religion, age, sex, national origin, disability or protected veteran status. You can find out more about your rights under the law at <a href="http://www.eeoc.gov/">www.eeoc.gov</a> If you are applying for a role and have a physical or mental disability, we will support you with your application or through the hiring process.

In the middle of the energy transition, businesses and governments are faced with significant challenges. But the pace and scale of change mean every decision is made&nbsp;under mounting pressure.&nbsp; Now, more than ever, companies need reliable data, analytics and actionable insight. Wood Mackenzie is the&nbsp;leading global provider of data and analytics solutions&nbsp;for the renewables, energy and natural resources sectors . Wood Mackenzie&rsquo;s services&nbsp;include data, analytics, insight, events and consultancy.&nbsp; A trusted partner for over 50 years, Wood Mackenzie&rsquo;s team has over 2,300 experts across more than 30 global&nbsp;locations who cover the entire supply chain. Wood Mackenzie&rsquo;s data and analytics empowers energy producers, governments and financial institutions to be confident in&nbsp;their investment decisions in the face of rapidly evolving markets. Part of the Veritas group.

Cyber Security Risk Manager

Wood Mackenzie is the global data and analytics business for the renewables, energy, and natural resources industries. Enhanced by technology. Enriched by human intelligence. In an ever-changing world, companies and governments need reliable and actionable insight to lead the transition to a sustainable future. That’s why we cover the entire supply chain with unparalleled breadth and depth, backed by over 50 years’ experience. Our team of over 2,400 experts, operating across 30 global locations, are enabling customers’ decisions through real-time analytics, consultancy, events and thought leadership. Together, we deliver the insight they need to separate risk from opportunity and make confident decisions when it matters most.<a href="https://www.woodmac.com/">WoodMac.com</a><a href="https://www.youtube.com/watch?v=Y4AVwhQJj_w&amp;t=10s">Wood Mackenzie Brand Video</a>Wood Mackenzie Values<ul><li>Inclusive – we succeed together</li><li>Trusting – we choose to trust each other</li><li>Customer committed – we put customers at the heart of our decisions</li><li>Future Focused – we accelerate change</li><li>Curious – we turn knowledge into action</li></ul>We are seeking a highly skilled Senior Cyber Security Risk Manager to join our global Cyber Security team. This individual will play a critical role in maturing our Governance, Risk, and Compliance (GRC) function, ensuring alignment with leading frameworks (NIST CSF, NIST 800-53, SOC 2) and maintaining readiness for external audits and regulatory requirements.As a senior member of the team, you will be directly responsible for the organization’s risk management strategy, including oversight of the enterprise risk register, execution of internal audits, and governance of our risk exception process (PERA). This role requires a blend of technical expertise, strong analytical skills, and the ability to engage effectively with stakeholders across IT, procurement, and business leadership.<h3>Key Responsibilities</h3><ul><li>Lead the cybersecurity risk management program, including maintaining and continuously improving the enterprise risk register.</li><li>Own and manage the Policy Exception Risk Acceptance (PERA) process, ensuring risks are reviewed, tracked, and formally accepted or remediated.</li><li>Drive SOC 2 readiness activities across multiple business units, coordinating with auditors and internal stakeholders to ensure successful certification and renewals.</li><li>Oversee internal audit planning and execution, ensuring annual audit plans are risk-based, comprehensive, and aligned with organizational objectives.</li><li>Develop and enforce cybersecurity governance policies, standards, and procedures aligned to NIST CSF, NIST 800-53, and SOC 2 requirements.</li><li>Partner with IT, SRE, Architecture, and Procurement teams to identify, assess, and mitigate technology, third-party, and compliance risks.</li><li>Provide clear, data-driven reporting and metrics to the Head of Cyber Security and CIO on risk trends, audit findings, and remediation progress.</li><li>Monitor the external threat and regulatory landscape to ensure emerging risks are factored into the risk management strategy.</li><li>Act as a trusted advisor to business leaders on cybersecurity risk, providing practical guidance that balances security with business objectives.</li></ul><h3></h3><h3>Requirements</h3><ul><li>5+ years of hands-on experience in a dedicated cybersecurity risk management, GRC, or equivalent senior role.</li><li>Proven experience leading risk management programs and working with frameworks such as NIST CSF, NIST 800-53, and SOC 2.</li><li>Strong knowledge of risk registers, audit programs, and exception management processes.</li><li>Experience in SOC 2 audit readiness and execution, with ability to engage directly with auditors and control owners.</li><li>Demonstrated ability to engage and influence senior stakeholders, translating complex technical risk into business terms.</li><li>Strong analytical skills, with ability to interpret data, assess trends, and make evidence-based decisions.</li><li>Excellent written and verbal communication skills, including the ability to prepare board-level risk reporting.</li></ul><h3></h3><h3>Preferred Attributes</h3><ul><li>SaaS or technology sector experience.</li><li>Familiarity with enterprise GRC tools (e.g., ServiceNow, Archer, or Purview Compliance Manager).</li><li>Experience supporting third-party risk management activities.</li></ul>Equal OpportunitiesWe are an equal opportunities employer. This means we are committed to recruiting the best people regardless of their race, colour, religion, age, sex, national origin, disability or protected veteran status. You can find out more about your rights under the law at <a href="http://www.eeoc.gov/">www.eeoc.gov</a>&nbsp;If you are applying for a role and have a physical or mental disability, we will support you with your application or through the hiring process.&nbsp;&nbsp;

Cyber Security Risk Manager

About the Job

About the Company

Wood Mackenzie

Similar Jobs

Cyber Incident Response Lead

Cyber Incident Response Lead

Manager - Cyber Security

Manager - Cyber Security

Director, Cybersecurity & Risk

Director, Cybersecurity & Risk

Cybersecurity Application Assessment Service Lead

Cybersecurity Application Assessment Service Lead

Senior / Lead Cybersecurity GRC Analyst

Senior / Lead Cybersecurity GRC Analyst

Senior ICT Risk Manager / Information Security Officer (ISO) (all genders)

Senior ICT Risk Manager / Information Security Officer (ISO) (all genders)

Security Compliance Analyst

Security Compliance Analyst

Lead Application Security Engineer

Lead Application Security Engineer

Vulnerability Management and Cyber Controls Lead

Vulnerability Management and Cyber Controls Lead

Director, CyberSecurity

Director, CyberSecurity