--- title: 'Director, Governance, Risk & Compliance at Anomali' canonical: 'https://feeny.ai/job/director-governance-risk-compliance-anomali-redwood-city-mn3kxj92ccy9' type: 'job' last_seen: '2026-09-13' --- # Director, Governance, Risk & Compliance at Anomali - **Company:** Anomali - **Location:** Redwood City, CA - **Employment:** full-time - **Work type:** hybrid - **Posted:** 2026-07-23 - **Last confirmed live:** 2026-09-13 - **Apply:** https://jobs.lever.co/anomali/b57bb3b1-c7ff-4d6d-a7fd-768f0d56a85d ## Job description Company Description: Anomali, headquartered in Silicon Valley, delivers the first Intelligence-Native Agentic SOC Platform — unifying a security data lake, the world's largest IOC repository, threat intelligence, and agentic AI into a single modern experience. The platform accelerates detection, investigation, and response, delivering earlier insights, faster action, and scalable modernization across any environment. Whether augmenting existing tools or delivering complete SOC capabilities end-to-end, Anomali empowers security teams to operate faster, smarter, and with confidence. Beyond Detecting. Start Deciding. Start Acting. Learn more at www.anomali.com Position Overview: Anomali is scaling its compliance program to support an AI-native cybersecurity platform used by governments and enterprises worldwide. We're looking for a hands-on GRC leader who can own and drive our multi-jurisdiction certification portfolio — spanning U.S. federal (FedRAMP), global (ISO 27001, SOC 2), and regional cloud security frameworks (UAE DESC, Saudi Arabia NCA/CCC, Australia IRAP) — while building the scalable compliance infrastructure to support continued international expansion. This is a builder role, not a maintainer role. You'll be the single point of accountability for keeping our certifications current, audit-ready, and strategically sequenced to unlock new markets and revenue. Key Responsibilities: Program Ownership & Strategy Own the end-to-end GRC roadmap across FedRAMP, ISO 27001, SOC 2, DESC (Dubai Electronic Security Center), Saudi NCA Cloud Cybersecurity Controls (CCC), Australia IRAP, and other regional cloud security/data residency frameworks as they arise Prioritize and sequence certification efforts against GTM and revenue targets, in partnership with sales, product, and executive leadership Serve as the primary liaison with assessors, auditors, and regulatory bodies (3PAOs, sponsoring agencies, in-country assessors) FedRAMP Manage ongoing FedRAMP authorization activities (ATO maintenance, continuous monitoring, SAR/POA&M remediation) in partnership with the 3PAO and sponsoring agency Own documentation quality (SSP, SAR, POA&M) and escalation management when assessor deliverables fall short ISO 27001 Maintain and evolve the ISMS, manage internal/external audit cycles, and drive continuous improvement of controls, risk assessments, and policy frameworks SOC 2 Own SOC 2 Type II audit readiness and execution (Security, Availability, and Confidentiality trust services criteria) in partnership with the external audit firm Manage evidence collection, control testing, and remediation of exceptions across annual audit cycles Ensure alignment between SOC 2 controls and overlapping ISO 27001/FedRAMP requirements to avoid duplicated audit effort Regional Cloud/Government Certifications Drive DESC CSP certification for UAE market access. The CSP Security Standard is based on the following international standards, which the candidate should be conversant in: ISO/IEC 27001:2013ISO/IEC 27002:2013ISO/IEC 27017:2015ISR:2017 v.02CSA Cloud Controls Matrix 3.0.1 Manage Saudi NCA compliance (ECC/CCC) in coordination with local partners Own Australia IRAP assessment process and coordination with registered assessors Monitor emerging regional requirements (e.g., additional Gulf, APAC, or EU frameworks) and advise on prioritization Risk & Controls Build and maintain a unified controls framework that maps overlapping requirements across all frameworks to avoid duplicated effort Own enterprise risk register, vendor/third-party risk management, and remediation tracking Partner with engineering and product teams to ensure security controls are designed in, not bolted on Cross-Functional Leadership Partner with internal cross-functional teams — IT, Security, Cloud Infrastructure, Engineering, and Product — to own and drive compliance outcomes end-to-end Support customer/prospect due diligence (security questionnaires, audit requests, trust portal) Partner with legal on regulatory obligations, data residency, and contractual compliance commitments Report compliance posture and risk to executive leadership and board as needed ## Qualifications Required Skills/Experience: 8+ years in GRC, information security compliance, or related audit/assurance roles, with 3+ years in a leadership capacity Direct, hands-on experience with FedRAMP (Moderate or High) as a CSP-side practitioner — not just advisory Demonstrated ownership of ISO 27001 certification and ongoing ISMS management Demonstrated ownership of SOC 2 Type II audits, from readiness through report delivery Experience with at least one Middle East cloud security framework (DESC, Saudi NCA/CCC, or equivalent) Familiarity with Australia IRAP assessment process Strong working knowledge of cloud security architecture (AWS/Azure/GCP) and how controls map to technical implementation Excellent stakeholder management — comfortable working directly with C-suite, auditors, and government sponsors Exceptional written communication skills (SSPs, policies, board-level reporting) For candidates residing within commutable distance of Redwood City, CA, this position will be hybrid.  Remote candidates based in the US, will also be considered. This position is not eligible for employment visa sponsorship.  The successful candidate must not now, or in the future, require visa sponsorship to work in the US. ## Preferred Qualifications Certifications: CISSP, CISA, CISM, or ISO 27001 Lead Auditor/Implementer Experience in a high-growth, venture-backed SaaS or cybersecurity company Prior experience managing multiple concurrent certifications across regions Experience with GRC tooling (Vanta, Drata, ServiceNow GRC, or similar) What Success Looks Like FedRAMP ATO maintained with zero material findings; audit cycles run predictably ISO 27001 recertification and surveillance audits pass without major nonconformities SOC 2 Type II report delivered annually with no material exceptions DESC, Saudi CCC, and IRAP certifications achieved on committed timelines, unlocking regional deals A documented, reusable controls framework that reduces redundant audit effort across all certifications Compliance treated as a competitive differentiator in sales cycles, not a bottleneck ## Equal Opportunities Monitoring It is our policy to ensure that all eligible persons have equal opportunity for employment and advancement on the basis of their ability, qualifications and aptitude. We select those suitable for appointment solely on the basis of merit without regard to an individual's disability, race, color, religion, sex, sexual orientation, gender identity, national origin, age, or status as a protected veteran. Monitoring is carried out to ensure that our equal opportunity policy is effectively implemented. If you are interested in applying for employment with Anomali and need special assistance or accommodation to apply for a posted position, contact our Recruiting team at recruiting@anomali.com. ## Compensation Transparency $180,000 - $230,000 USD Please note that the annual base salary range is a guideline and, for candidates who receive an offer, the base pay will vary based on factors such as work location, as well as, knowledge, skills and experience of the candidate. In addition to base pay, this position is eligible for benefits, and may be eligible for a bonus and/or equity. ## About Anomali ## Company Overview - **One-liner**: Anomali is an AI-driven cybersecurity platform that unifies a security data lake, threat intelligence, and agentic AI to help security teams detect, investigate, and respond to cyber threats from one platform. - **Entity Type**: Private (venture-backed; 5 prior funding rounds, $96.3M total funding) - **Headquarters**: Redwood City, California, United States (with offices/employees across 18 countries including UK, UAE, Saudi Arabia, and Colombia) - **Founded**: 2013 (originally as ThreatStream; rebranded to Anomali in 2016) - **Founders**: Greg Martin and Colby DeRodeff (per LinkedIn). Note: Anomali's own company page credits Hugh Njemanze as founder and Wei Huang as CTO — conflicting reports, likely reflecting different founding/leadership narratives. ## Core Business - **Primary industry**: Cybersecurity (Computer and Network Security), specifically Security Operations platforms, threat intelligence, and AI-driven security analytics. - **Target customers**: Global enterprises, government agencies, and security teams across finance, manufacturing, transportation, and technology sectors. - **Mission or purpose statement**: From the company's careers page: "We're building the next generation of cybersecurity solutions — powered by AI, driven by innovation, and committed to protecting organizations worldwide." The company also emphasizes helping customers "achieve more with less" by simplifying security operations. ## Products & Services - **Anomali Unified Security Data Lake**: Cloud-native platform that ingests, retains, and analyzes massive volumes of security telemetry (cloud, endpoint, network, identity) for real-time and historical analysis at scale, without the performance limits or cost penalties of legacy SIEMs. - **ThreatStream Next-Gen**: Threat intelligence platform that continuously enriches the data lake with real-world threat intelligence — actors, infrastructure, TTPs, and campaigns — so analysts understand who, why, and what next. - **Agentic AI**: AI-driven agents that reason over the data lake and intelligence context to guide investigations, recommend next actions, and automate triage and response workflows while keeping human control and auditability. - **Additional legacy/related products** (per LinkedIn): Anomali Match, Anomali Lens, and Security Analytics. ## Market Standing - **Valuation/Market Cap**: Not disclosed (private company). - **Key Metric**: Annual revenue estimated at $57.1M; total funding $96.3M across 5 rounds (per LinkedIn company data). - **Notable Investors/Partners**: Specific investor/partner names were not included in the search results; the company markets itself as trusted by global enterprises and government organizations. - **Growth Signals**: Workforce of ~184 employees distributed across 18 countries; LinkedIn followers ~26,973 (+14.6% YoY). Note: headcount is down ~4.7% YoY per LinkedIn data, yet the company describes itself as "rapidly growing" and currently lists 10+ open positions (Sales, Product, Engineering, GRC, and channel roles). The current CEO, Ahmed Rubaie, has led a transformation into an AI-native security operations platform since 2021. ## Competitive Advantages - **Platform consolidation**: Replaces/augments ETL, SIEM, XDR, SOAR, and TIP in one platform, reducing tool sprawl and operational complexity. - **AI-native architecture**: Built from the ground up as an AI-powered Agentic SOC platform, not a legacy SIEM with AI bolted on. - **Founding/leadership pedigree**: Team includes former CIOs/CISOs and the original builders of the first SIEM, TIP, and "true Copilot," giving deep security-domain credibility. - **Unified data + intelligence + action**: The combination of a hyperscale security data lake, continuous threat intelligence enrichment, and governed agentic AI is a differentiator versus point solutions. ## Strategic Focus - **Agentic SOC vision**: Pushing the industry toward an "Agentic SOC" where AI agents perform triage, investigations, and response at machine speed, with human governance. - **Replacing legacy SIEM limitations**: Targeting organizations frustrated by the cost and performance ceilings of traditional SIEM, SOAR, and XDR platforms. - **AI-driven decisioning layer**: Building what the company calls a "governed decisioning layer" for enterprises to go beyond detection and start acting. ## Why Work Here - **Culture**: Anomali describes a culture of continuous learning, collaboration, and empowerment, with values centered on integrity, innovation, teamwork, humility, empathy, and servant leadership. They explicitly position themselves as "not your typical tech company." - **Remote/hybrid**: Many roles are remote (US Remote, UK Remote), with in-office presence in Redwood City, CA (including a part-time front desk & office assistant role) and Belfast (UX Designer). International employees have country-specific policies. - **Benefits (US-based employees)**: - Medical, dental, and vision insurance; prescription drug coverage; short- and long-term disability; life insurance (2x salary); AD&D coverage — all effective on day one. - Gym reimbursement, mental health apps, Employee Assistance Programs (EAP), and wellness initiatives. - 401(k) with company match and pension; competitive compensation; equity grants; FSA and pre-tax commuter benefits. - Unlimited flexible time off (FTO) for US employees; paid holidays per local calendar; office lunch and refreshments at HQ. - **Professional development**: Education and training program, Buddy Program for new hires, and lunch-and-learn sessions across teams and topics. ## Sources 1. [anomali.com — Careers](https://www.anomali.com/company/careers) 2. [anomali.com — About](https://www.anomali.com/company) 3. [lever.co — Anomali Open Positions](https://jobs.lever.co/anomali) 4. [anomali.com — Homepage](https://www.anomali.com/) 5. [linkedin.com — Anomali Company Page](https://www.linkedin.com/company/anomali) ## Other roles at Anomali - [Channel Account Director (Western US)](https://feeny.ai/job/channel-account-director-western-us-anomali-san-diego-jep81kbtm1pv) — San Diego, CA - [Associate Account Executive - Cybersecurity SaaS (Detroit)](https://feeny.ai/job/associate-account-executive-cybersecurity-saas-detroit-anomali-detroit-kf68bphh1r7z) — Detroit, MI - [Senior AI Product Architect (US Remote)](https://feeny.ai/job/senior-ai-product-architect-us-remote-anomali-dallas-kzhtg1ss92c0) — Dallas, TX - [Senior Technical Account Manager - SIEM/Security Analytics (US Remote)](https://feeny.ai/job/senior-technical-account-manager-siem-security-analytics-us-remote-anomali-wcb7fxx4dg04) — Dallas, TX - [Director, Global Sales Development - Enterprise SaaS (Remote US)](https://feeny.ai/job/director-global-sales-development-enterprise-saas-remote-us-anomali-dallas-ry6yzg90r205) — Dallas, TX - [Vice President, Global Sales Engineering (US Remote)](https://feeny.ai/job/vice-president-global-sales-engineering-us-remote-anomali-dallas-3psmzn8p0gx0) — Dallas, TX - [Senior Account Manager - KSA](https://feeny.ai/job/senior-account-manager-ksa-anomali-riyadh-5cddvehadb5v) — Riyadh, Saudi Arabia - [Director, Governance, Risk & Compliance](https://feeny.ai/job/director-governance-risk-compliance-mx-technologies-inc-lehi-utah-k0g5rk6dz2ys) — Lehi Utah, United States