Sr. Staff, Cybersecurity Risk Management

Welcome to Warner Bros. Discovery… the stuff dreams are made of.

Who We Are…

When we say, “the stuff dreams are made of,” we’re not just referring to the world of wizards, dragons and superheroes, or even to the wonders of Planet Earth. Behind WBD’s vast portfolio of iconic content and beloved brands, are the storytellers bringing our characters to life, the creators bringing them to your living rooms and the dreamers creating what’s next…

From brilliant creatives, to technology trailblazers, across the globe, WBD offers career defining opportunities, thoughtfully curated benefits, and the tools to explore and grow into your best selves. Here you are supported, here you are celebrated, here you can thrive.

THE JOB

The Sr. Staff, Cybersecurity Risk Management is responsible for leading the assessment, governance, and continuous improvement of cyber risk across WBD’s global technology environment. This role drives a risk-based, data-driven approach to identifying, quantifying, prioritizing, and mitigating risk across cloud, application, infrastructure, and production systems.

A core responsibility of this role is owning and evolving the global cybersecurity risk exception process, and the security risk register, including defining governance, evaluating compensating controls, and ensuring consistent risk-based decision-making across the enterprise.

This role partners closely with Product Owners, Business Control Owners, Technology Operations, DTC, and Engineering teams to embed risk management into the SDLC and operational processes, while leveraging deep technical expertise in cloud architectures, vulnerability management, and control evaluation.

The position requires hands-on engagement with modern security tooling and architecture, enabling the translation of complex technical risk into actionable business insights and measurable risk reduction outcomes.

RISK OVERSIGHT & TECHNICAL GOVERNANCE

Own and continuously enhance the enterprise cybersecurity risk management framework, aligned to NIST, ISO, PCI, SOX, SWIFT, and internal standards

Lead end-to-end risk assessments across cloud, infrastructure, application, and third-party environments

Drive risk quantification and prioritization based on business impact, exploitability, and control effectiveness

Oversee the enterprise risk register, including identification of systemic risks and aggregation of risk themes

Evaluate security control design and effectiveness, recommending remediation and compensating controls

Assess complex environments leveraging expertise in solution architecture, system integrations, and modern technologies (e.g., microservices, APIs, containerized workloads, AI, and cloud identity/security models)

Apply advanced knowledge of secure SDLC practices (CI/CD, infrastructure-as-code, integration patterns) to assess risk and validate controls

Own and govern the global cybersecurity risk exception program, including lifecycle management, standardization, and continuous improvement

Define and enforce risk-based approval criteria, ensuring alignment with enterprise standards and regulatory requirements

Evaluate compensating controls and technical trade-offs using deep understanding of architecture and security design patterns

Standardize exception documentation, validation, reporting, and periodic review processes

Drive reduction of exception volume and recurrence through root cause analysis and systemic remediation initiatives

Ensure consistent exception handling across global teams, platforms, and environments, and integration into the enterprise risk register

Partner with Legal, Compliance, and business teams to embed risk-based decision-making into enterprise processes

Monitor the evolving threat landscape and adjust risk posture, assessments, and priorities accordingly

Support and lead cyber security compliance assessments globally across WBD, improving control design and compliance with WBD policies

STRATEGIC LEADERSHIP, BUSINESS PARTNERSHIP & ENABLEMENT

Act as a trusted advisor to technology and business leaders on cybersecurity risk decisions

Translate technical risk into clear, actionable insights that inform prioritization and investment decisions

Drive adoption of enterprise risk methodologies, frameworks, and tooling

Lead cross-functional initiatives to:

Reduce recurring risk exceptions

Improve enterprise security posture

Embed risk ownership within engineering and product teams

Influence and align stakeholders across DTC, product, infrastructure, and enterprise platforms

Support other cybersecurity risk professionals, fostering technical depth and collaboration

Drive risk-based vulnerability prioritization, incorporating exploitability, asset criticality, exposure, and threat intelligence

Manage competing priorities in a high-volume, fast-paced environment

REPORTING & ANALYTICS

Develop and track KPIs and KRIs for exception management (e.g., aging, approval rates, Define and track KPIs and KRIs for risk and exception management (e.g., aging, SLA adherence, recurrence trends)

Develop and deliver executive-level dashboards and reporting (e.g., Power BI)

Provide analytics across:

Vulnerability remediation trends

Exception volumes, aging, and approval rates

Control effectiveness and systemic risk patterns

Design and maintain data-driven reporting models and pipelines integrating data from ServiceNow IRM, Tenable, Wiz, Brinqa, and other platforms

Ensure data quality, integrity, and consistency across reporting outputs

Translate complex technical data into concise, leadership-ready insights

Support executive, audit, and regulatory reporting requirements

Partner with VM, cloud, infrastructure, and application teams to:

Drive risk-based remediation of critical vulnerabilities

Enforce remediation accountability and timelines

Escalate systemic or aged issues impacting risk posture

Support and enhance VM Remediation COE operations, including governance, process standardization, and reporting maturity

THE ESSENTIALS

10+ years of experience in cybersecurity risk, compliance, or related technical domains, including leadership of complex initiatives

Deep expertise in:

Cyber risk frameworks (NIST, ISO, PCI, SOX)

Vulnerability management and risk prioritization

Cloud security (AWS, Azure, GCP) and modern application architectures

Security control design and compensation control strategies

Strong technical understanding of:

Cloud IAM, network security, and workload protection

Secure SDLC, CI/CD pipelines, and system integrations

Complex distributed systems and enterprise environments

Experience with GRC and security tooling (ServiceNow IRM, Tenable, Wiz, Brinqa, Power BI)

Proven ability to assess complex technical environments and translate risk into business impact

Strong communication skills, with the ability to influence senior stakeholders and translate technical concepts into business language

Advanced analytical, problem-solving, and program management capabilities

Ability to manage multiple priorities in dynamic, fast-paced environments

Strong attention to detail, organizational skills, and commitment to high-quality deliverables

Bachelor’s degree in Computer Science, Engineering, IT, or related field

Relevant certifications (CISSP, CISM, CRISC, CISA) preferred

Proven ability to assess complex technical environments and translate risk into business impact.

Exceptional communication skills with the ability to influence senior and executive stakeholders.

Strong analytical, problem-solving, and program management capabilities.

THE NICE TO HAVES

6+ years of prior experience in a related field (media, entertainment, business development or streaming services industry experience a plus).

Familiarity with streaming and similar products/services.

4+ years of Big 4 experience or in a related field (media, entertainment, business development or streaming services industry experience a plus).

Experience working in a national or global company.

Comfortable working in a highly iterative environment, both structured and unstructured.

Risk mitigation experience with AWS and/or other Cloud Databases such as Azure, GCP, etc.

Metrics and visualization tools knowledge a plus.

Advanced user of Microsoft Office (Excel, PowerPoint, Word) for executive reporting and deliverables

Experience supporting PCI or other regulated environments.

Advanced experience with metrics, analytics, and visualization tools (i.e. Power BI, Tableau).

How We Get Things Done…

This last bit is probably the most important! Here at WBD, our guiding principles are the core values by which we operate and are central to how we get things done. You can find them at www.wbd.com/guiding-principles/ along with some insights from the team on what they mean and how they show up in their day to day. We hope they resonate with you and look forward to discussing them during your interview.

Championing Inclusion at WBD

If you’re a qualified candidate with a disability and you require adjustments or accommodations during the job application and/or recruitment process, please visit our accessibility page for instructions to submit your request.