Risk Manager

About Ping Identity :

At Ping Identity , we believe in making digital experiences both secure and seamless for all users, without compromise. We call this digital freedom. And it's not just something we provide our customers. It's something that inspires our company. People don't come here to join a culture that's built on digital freedom. They come to cultivate it.

Our intelligent, cloud identity platform lets people shop, work, bank, and interact wherever and however they want. Without friction. Without fear.

While protecting digital identities is at the core of our technology, protecting individual identities is at the core of our culture. We champion every identity. One of our core values, Respect Individuality, reminds us to celebrate differences so you are empowered to bring your authentic self to work.

We're headquartered in Denver, Colorado and we have offices and employees around the globe. We serve the largest, most demanding enterprises worldwide, including more than half of the Fortune 100. At Ping Identity , we're changing the way people and businesses think about cybersecurity, digital experiences, and identity and access management.

As Risk Manager, you will lead the identification, assessment, treatment, monitoring, and reporting of information security and business risks across Ping Identity . You will help ensure that risk decisions are consistent, evidence-based, clearly communicated, and aligned with the company’s objectives, risk appetite, and customer trust commitments.

You will partner with stakeholders across Enterprise Security, Engineering, Product, Legal, Privacy, People Team, Sales, Customer Success, and Finance to maintain and continuously improve Ping Identity ’s risk management practices and supporting governance. Your work will connect enterprise risk management with the Information Security Management System (ISMS), Business Continuity Management System (BCMS), AI Management System (AIMS), control environment, customer assurance capability, and audit readiness.

You will balance strong risk oversight with pragmatic execution, helping the organisation understand its most material risks, make informed trade-offs, and track risk treatment through to measurable resolution. You will also contribute to a scalable operating model through clear governance routines, useful metrics, effective stakeholder engagement, and continuous improvement.
What You’ll Do
You will:

-
Run and continuously improve the information security risk management lifecycle, including risk identification, assessment, prioritisation, treatment, acceptance, monitoring, and reporting.

-
Run enterprise, business-unit, project, technology, and third-party risk assessments, ensuring risks are evaluated consistently and documented with clear business context.

-
Maintain risk registers, risk statements, treatment plans, action owners, due dates, and escalation paths, ensuring material risks remain visible and actively managed.

-
Define and monitor risk appetite, tolerance indicators, key risk indicators, and management reporting that support timely decision-making by security and business leadership.

-
Advise senior leaders and control owners on risk acceptance, mitigation options, compensating controls, residual risk, and escalation requirements.

-
Partner with control owners and business stakeholders to improve control design, evidence quality, remediation effectiveness, and the connection between controls and material risks.

-
Maintain and improve the ISMS, BCMS, and AIMS risk components, including policies, standards, procedures, risk methodologies, control mappings, and governance records.

-
Coordinate risk-related inputs to internal and external audits, customer assurance activities, regulatory requests, and security questionnaires.

-
Oversee third-party and supplier risk activities, including inherent risk assessments, due diligence, risk treatment, ongoing monitoring, issue management, and exceptio