Cybersecurity Staff Engineer
About the role
We're looking for a seasoned Cybersecurity Staff Engineer to lead our Cyber Governance, Risk, and Compliance efforts — one of the most strategically critical functions in our security organization.
Responsibilities
Aggregate risk posture, control gaps, and issue status across all cybersecurity towers into cohesive dashboards and executive-ready reporting frameworks.
Translate disparate signals into a coherent organizational risk picture.
Own end-to-end issue lifecycle management — from identification through remediation — ensuring findings don't stall in handoff gaps.
Build accountability mechanisms across tower leads and partner teams that keep risk closure on track without requiring direct authority.
Escalate systemic issues and trend patterns to senior leadership with actionable recommendations.
Lead all aspects of ISO 27001 certification maintenance, including evidence collection, control mapping, audit readiness, and continuous improvement.
Manage relationships with external auditors and certification bodies to ensure the program remains audit-ready year-round.
Contribute into our SOC 2 Type II program and lead compliance posture across applicable trust service criteria.
Coordinate with engineering, IT, and operations teams to ensure controls are implemented, evidenced, and sustainable.
Conduct and document Level 1 cyber risk assessments using established frameworks including NIST CSF and ISO 27001.
Maintain the enterprise cyber risk register, ensuring risks are properly rated, owned, and tracked toward resolution.
Surface emerging risks tied to our industry — fan data systems, broadcast infrastructure, global event operations — with appropriate context for decision-makers.
Partner with tower leads, IT, Legal, Privacy, and Procurement to align on risk priorities and drive coordinated remediation.
Communicate policy and regulatory requirements in language that resonates with both technical practitioners and executive stakeholders.
Operate as a trusted advisor across the organization — influencing outcomes without relying on org chart authority.
Identify opportunities to replace manual compliance effort with scalable automation through GRC platforms and integrations.
Drive adoption and optimization of tools such as Drata, ServiceNow GRC, OneTrust, or equivalent platforms.
Stay ahead of the tooling landscape and bring forward recommendations that improve program efficiency and coverage.
Maintain working knowledge of regulations relevant to our global footprint — including GDPR, CCPA, and evolving data residency requirements across international markets.
Support third-party and vendor risk review processes in coordination with Legal and Procurement, ensuring vendor relationships meet our compliance standards.
Develop and execute incident response coordination at the GRC level — ensuring compliance obligations are met when security incidents occur.
Be a strong systems thinker who understands how risk and compliance data flows across tools, teams, and processes — and can identify where the gaps live.
Be an excellent written and verbal communicator — equally effective presenting to a CISO and partnering with a technical tower lead.
Be a proven influencer at the Director level and above, with a track record of driving accountability without direct authority.
Familiarity with broadcast or live event infrastructure risk considerations a plus.
Qualifications
7+ years of progressive experience in Cybersecurity GRC, Risk Management, or Compliance with exposure to both program ownership and cross-functional coordination.
Demonstrated ability to manage across multiple security domains simultaneously without losing precision or accountability.
Hands-on experience leading ISO 27001 certification programs and SOC 2 Type II compliance — you've owned audit cycles, not just supported them.
Familiarity with one or more GRC platforms (Drata, ServiceNow, OneTrust, or equivalent).
CISSP, CISM, or CRISC certification preferred.
Experience in sports, entertainment, media, or other high-profile consumer-facing industries a plus.
Skills/Knowledge
Deep fluency in security and compliance frameworks — ISO 27001, NIST CSF, and CIS Benchmarks — and the ability to translate framework requirements into operational controls.
Working knowledge of GDPR, CCPA, and data residency obligations across global markets, with the ability to assess their impact on program design and risk posture.
Familiarity with IAM principles and data protection methods (encryption, tokenization) sufficient to evaluate control effectiveness across security towers.
Ability to develop and execute incident response coordination at the GRC level — ensuring compliance obligations are met when security incidents occur.
Strong systems thinker who understands how risk and compliance data flows across tools, teams, and processes — and can identify where the gaps live.
Skilled at identifying where automation can replace manual compliance effort, and credible enough to bring stakeholders along on the change.
Excellent written and verbal communicator — equally effective presenting to a CISO and partnering with a technical tower lead.
Proven influencer at the Director level and above, with a track record of driving accountability without direct authority.
Familiarity with broadcast or live event infrastructure risk considerations a plus.
Benefits
Employees currently are eligible to receive an annual discretionary performance bonus, awarded at the sole discretion of the Company and subject to any terms and conditions set by the Company. Employees and/or eligible dependents may be eligible to participate in the following Company-sponsored employee benefit programs: medical; dental; vision; life/AD&D insurance; short- and long-term disability; fertility and family-forming assistance; wellbeing allowance; educational assistance; mental health coaching/therapy; tax advantaged accounts such as HSA and healthcare/dependent care FSAs; a 401(k) retirement plan; and time off benefits that include vacation, sick time, and personal days.
Pay
$172,500-$195,000
Schedule
Full-time
Company
The NBA is committed to providing a safe and healthy workplace. To safeguard our employees and their families, our visitors, and the broader community from COVID-19, and in consideration of recommendations from health authorities and the NBA’s own advisors, any individual working onsite in our New York and New Jersey offices must be fully vaccinated against COVID-19. The NBA will discuss accommodations for individuals who cannot be vaccinated due to a medical reason or sincerely held religious belief, practice, or observance.
About the NBA
The National Basketball Association (NBA) is a global sports and media organization with the mission to inspire and connect people everywhere through the power of basketball. Built around five professional sports leagues: the NBA, WNBA, NBA G League, NBA 2K League and Basketball Africa League, the NBA has established a major international presence with games and programming available in 214 countries and territories in 60 languages, and merchandise for sale in more than 200 countries and territories on all seven continents. NBA rosters at the start of the 2024-25 season featured a record-tying 125 international players from a record-tying 43 countries. NBA Digital’s assets include NBA TV, NBA.com, the NBA App and NBA League Pass. The NBA has created one of the largest social media communities in the world, with more than 2.3 billion likes and followers globally across all leagues, team and player platforms. NBA Cares, the NBA’s global social responsibility platform, partners with renowned community-based organizations around the world to address important social issues in the areas of education, inclusion, youth and family development, and health and wellness.