Risk & Controls Manager

As a Risk & Controls Manager at ConsenSys, you run the internal posture engine that keeps risk state current for leadership and the Risk Committee. You own the risk register, critical control monitoring, evidence management, audit operations, and GRC tooling in Drata, ensuring the organization maintains a defensible, current security posture.

What you'll do

• Operate the risk register from the Security Programme threat model: populate, track treatment, record acceptance decisions, follow up with owners, and maintain the exceptions register.
• Keep the ISMS and security policy library current as part of audit readiness, and draft security standards when commissioned by the Lead.
• Run Drata as the control and evidence system, managing the Statement of Applicability, framework crosswalks, and automation.
• Run critical control monitoring: health check-ins, drift flags, and Drata automation, routing drift to the SOC and maintaining the evidence file for Lead assessments and internal audit.
• Feed threat-assessment findings into the register and confidence ratings, tracking which required assessments are current.
• Lead audit coordination and preparation for ISO 27001 and SOC 2, including ISMS readiness, team prep, management-review packs, and customer due-diligence questionnaires.
• Coordinate the control register for external testing (red team, tabletop, pentest), and run security awareness and weekly alerts.
• Track residual risk, exceptions, and gap-closure against appetite, and report register state and evidence health to the Lead and Risk Committee.
• Be accountable for a current, defensible posture engine with register, evidence, and audit operations, ensuring Drata collects evidence continuously with automated evidence where coverage exists.

What you bring

• Hands-on experience running a risk register, control library, and audit cycle for ISO 27001 and/or SOC 2.
• Comfortable working with GRC platforms such as Drata and turning monitoring into evidence.
• Proven ability to coordinate audits and customer questionnaires with named control owners.
• Precise written work, with demonstrated attention to register and Statement of Applicability quality.
• Strong stakeholder management skills with control owners and auditors.
• CISA, ISO 27001 Lead Implementer or Auditor certification, or equivalent professional certification.

What we offer

• US pay range of $150,000-$206,000 USD, not including bonus, equity, or other benefits (for US-based candidates; compensation for candidates outside the US will be determined based on location, experience, and skills during the interview process).

About ConsenSys

ConsenSys is the team behind MetaMask, the most trusted self-custodial financial platform on the internet with 100M+ downloads and users in approximately 190 countries. The company is building the operating system for Open Money, a remote-first global team rebuilding how money works.