Sr. Manager GRC

At Bloom Energy, our vision for a world powered by clean, reliable, and affordable energy is more than just a dream—we’re making it reality. For over two decades, we’ve been at the forefront of the global energy transition, pioneering solutions that empower critical industries to thrive in a rapidly digitizing, energy-intensive world. From revolutionizing power for AI-driven data centers to ensuring resilience for hospitals, electric grids, manufacturing facilities, and utilities, our solid oxide fuel cell (SOFC) and solid oxide electrolyzer (SOEC) technologies are redefining what’s possible by delivering energy abundance for all.

About the role

We are looking for a Senior Manager, GRC (Governance, Risk, and Compliance) to join our team. This role will report to our Chief Security Officer and is based in San Jose, CA. This is a fully on-site, in-office role 5 days a week. The Senior Manager, GRC will lead the strategy, implementation, and effective management of Bloom Energy’s GRC framework, aligning security policies and procedures with business goals, managing enterprise-level cyber security risks, and ensuring compliance with laws and standards (e.g., ISO 27001, CIS, GDPR, PCI-DSS).

Responsibilities

• Governance: Develop and maintain security policies, procedures, frameworks, and standards, ensuring alignment with business objectives. Drive enterprise-wide security training program.
• Risk Management: Oversee enterprise cyber security risk assessments, identify vulnerabilities, implement mitigation strategies, and manage third-party risk. Maintain central risk register. Collaborate with central enterprise risk management function. Support sales by timely filling out security questionnaires.
• Compliance: Ensure adherence to internal policies, industry standards (e.g., ISO 27001, CIS, NIST CSF), and external regulations (e.g., GDPR, CCPA, NERC-CIP, SOX). Primary liaison with external auditors for security compliance.
• Leadership: Lead and mentor the GRC team, foster a culture of compliance, and drive strategic GRC initiatives.
• Stakeholder Management: Collaborate with IT, legal, enterprise risk management, engineering, and business leaders; act as a liaison with auditors and regulators; and provide executive reporting.
• Reporting & Metrics: Establish metrics to track policy and compliance adherence and provide senior management with risk insights and compliance status on a regular basis.

Requirements

• Strong background in IT Security, Risk Management, and Compliance.
• Expertise in relevant laws, regulations, and frameworks such as ISO27001, NIST CSF, CIS.
• Experience driving several security programs leading to compliance, including:
  • Security & vulnerability management
  • Change management
  • Logging environments
  • Periodic review of Active Directory, Group Policy, and Access Management
  • Automated evidence collection
• Excellent leadership, communication, and stakeholder management.
• Strategic thinking and problem-solving abilities.
• Experience with GRC tools, policies, standards, and procedures.
• Ability to function as a self-directed team leader, organizing work and meeting deadlines.
• Identify effectiveness & efficiency improvement initiatives and work toward completing these goals.
• High standards for consistency & quality within personal and team performance.
• Ability to work flexible hours to collaborate with global team.
• Ability and desire to obtain industry-relevant compliance knowledge/certifications.

Qualifications

• Bachelor's degree preferred.
• 12+ years of relevant industry experience with 7+ years in Compliance.
• Familiarity with various compliance standards including ISO27001, GDPR, CIS, NIST CSF.

Pay

Salary range: $178,800 - $257,200 USD yearly.

Benefits

• Comprehensive medical, dental, and vision plans with large employer contribution.
• 401(k) Retirement Plan with company match.
• Mental Health Support services.
• Legal services.
• Virtual Physical Therapy access.
• Fertility & Family Forming benefits.

Schedule

This is a full-time, on-site role requiring 5 days a week in the office.