Remote opportunity at
CanonicalSecurity Risk Management Specialist
Canonical is hiring a Security Risk Management Specialist to help define how the company finds, tracks and cuts down security risk. The job is full-time and…
Career Tools
About This Role
Canonical is hiring a Security Risk Management Specialist to help define how the company finds, tracks and cuts down security risk. The job is full-time and remote. The team that owns this work sets the strategy and methods for managing risk across all of Canonical's activity, drawing on established practice and on fresh threat intelligence to inform decisions. The specialist helps lay out and carry out a wide strategic plan…
Job Description
Canonical is hiring a Security Risk Management Specialist to help define how the company finds, tracks and cuts down security risk. The job is full-time and remote. The team that owns this work sets the strategy and methods for managing risk across all of Canonical's activity, drawing on established practice and on fresh threat intelligence to inform decisions.
The specialist helps lay out and carry out a wide strategic plan for the security risk program. The work spans identifying risk, measuring it, analyzing its impact and modeling it, and reaches into many teams across the organization. The group also feeds requirements into product security, which ultimately protects Ubuntu users against attacks.
A large share of the job is creating standards and tools that others will use. The specialist writes risk standards and playbooks, reviews and improves current practice, and assesses and adopts new requirements, tools and methods. Self-service templates are part of that, as are training materials built with the organizational learning team.
Quantitative work is central. The specialist applies statistical models to frameworks such as FAIR, helps build key risk and performance indicators, and leads quantified assessments. Findings are turned into plain business terms, and campaigns are run to measure and reduce risk across the company.
The team also speaks beyond Canonical. Its members may pass threat information to the broader community, give talks at public events and industry gatherings, or sit on sector governance bodies. The specialist is expected to design evaluation methods that show whether security functions are performing well.
Candidates should have a strong academic record and a first degree in computer science or a STEM subject, or a compelling alternative route. Expertise in threat modeling and risk management frameworks is required, along with a broad understanding of how to run security risk management in practice, and experience applying secure development practices and security-by-design principles. Leadership ability, polished business English for writing and presenting, and a drive to exceed expectations are also sought.
Responsibilities
- Write Canonical's security risk standards and playbooks
- Review and improve security risk practice across the company
- Assess, choose and roll out new security requirements, tools and methods
- Build security risk learning materials with the organizational learning team
- Bring statistical modeling into frameworks such as FAIR
- Lead quantified assessments and translate cyber risk analysis into business terms
- Help develop key risk and performance indicators for security programs
- Launch campaigns that assess and reduce security risk company-wide
Requirements
- Strong academic record from school and university
- A first degree in computer science or a STEM discipline, or a convincing alternative route
- Drive and a history of exceeding what is asked
- Leadership and management ability
- Polished business English for writing and presenting
- Expertise in threat modeling and risk management frameworks
- Broad understanding of how to put security risk management into practice
- Experience applying secure development practices and security-by-design principles
Qualifications
- Visible thought leadership through talks and industry events
- Ability to design evaluation methods and performance indicators for security functions
Core Skills
Benefits
- Remote-first setup with in-person team sprints twice a year
- Yearly USD 2,000 allowance for personal skill development
- Yearly pay review, performance-linked bonus and recognition awards
- Paid annual leave plus maternity and paternity leave
- Confidential employee support program
- Chances to visit new cities and meet teammates in person
- Priority Pass access and upgraded seats on long-haul company trips
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the Security Risk Management Specialist role remote?
Yes. The posting lists the role as remote and full-time.
Which risk frameworks does the role use?
The posting names FAIR as an example of a framework for statistical modeling, alongside sensitivity analysis and other approaches.
What background is expected?
The posting asks for a first degree in computer science or a STEM discipline, or a compelling alternative route, plus expertise in threat modeling and risk management frameworks.
Is a salary listed?
No salary figure is given. The posting says pay considers location, experience and performance.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
