Lead Risk Engineer

About this role

College Board – Technology – Risk Engineering
Location: This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).
Type: This is a full-time position
About the Team
College Board’s Enterprise Security Engineering (ESE) team currently consists of 6 full-time staff and additional contractors. ESE is responsible for implementing and managing cutting-edge security solutions and tools. We protect the confidentiality, integrity and availability of data and endpoints across physical and cloud environments. We protect workloads and data in AWS and Azure, corporate networks, user endpoints around the country and data in SaaS and PaaS environments. We enable our developers and colleagues to deliver new, secure digital offerings that include the Digital SAT and AP exams. The work we perform supports the College Board’s mission to connect students to college success and opportunity. College Board is committed to creating an inclusive environment where all team members feel valued, respected, and supported in their work. We welcome individuals from diverse backgrounds and experiences to join our team and contribute to our ongoing success.
About the Opportunity
As a Lead Risk Engineer, you will provide technical leadership for how College Board identifies, reviews, and manages risk across its technology systems. College Board's technology footprint spans cloud infrastructure, vendor and API integrations, identity and access for automated systems, and an expanding set of AI and agentic capabilities — and the organization needs a consistent, repeatable practice for assessing risk across all of it, not AI alone. This role exists to build and lead that practice.
You will work within an existing security engineering team and across the Technology division to run risk reviews of new and existing systems, define controls and identity practices for automated and machine-driven access (including AI agents and non-human identities where relevant), and partner with stakeholders across the organization to bring security into decisions early. You will not only execute this work — you will shape the standards, patterns, and practices that let others execute it consistently, and you will lift the engineers around you through mentoring, paired reviews, and shared knowledge rather than becoming a single point of expertise.
This is a role for a technical leader comfortable operating across team and service boundaries, spanning risk domains where standards are still maturing — from cloud and vendor risk to identity and access for automated systems to emerging technologies such as agentic AI. You will contribute to the strategic direction of the risk engineering program — identifying risks and opportunities that influence roadmap decisions — while remaining hands-on in reviews, threat modeling, and control design. Your impact will be measured in durable outcomes: reviews that are repeatable and evidenced, risk that is owned and documented rather than assumed, and stakeholders across the organization who engage security early because the engagement is practical and predictable.
In this role, you will:
Lead operational risk reviews and delivery enablement (45%)

Lead risk-based security reviews of technology implementations across domains — including cloud architecture, application security, vendor/third-party integrations, identity and access, and emerging technologies such as GenAI and agentic AI systems — assessing architectures, data flows, data classification handling, and misuse scenarios.

Evolve the risk review practice into a documented, repeatable methodology with risk tiering, reusable templates, decision records, and findings tracking.

Define and maintain secure-by-default standards, patterns, and reference guidance that reduce review friction and enable delivery teams to meet expectations on the first pass.

Cross team and service boundaries to unblock delivery — translating risk and governance requirements into practical implementation steps that fit Agile delivery, and anticipating risks before they become launch blockers.

Where systems involve automated or autonomous behavior (e.g., AI agents, service accounts, machine identities), assess and document ownership, credential scope, and control requirements as part of the standard review.

Drive cross-organizational risk alignment (30%)

Serve as a primary security/risk partner to organization-level teams and governance bodies — including teams driving responsible AI use, such as GenAI Studio and the GenAI Governance Committee, as well as platform, procurement, and legal stakeholders — establishing recurring consultation touchpoints and pre-procurement engagement.

Embed risk requirements into tool onboarding, procurement, and vendor contract processes (e.g., data handling, retention and no-train terms, telemetry expectations, identity and access provisions).

Identify emerging or higher-uncertainty risk areas early — including agentic AI, non-human identities, and new integration patterns — and bring them into the standard review process rather than handling them ad hoc.

Build program maturity and grow the team (25%)

Define risk acceptance criteria, control requirements, and escalation thresholds; ratify them through appropriate governance bodies and apply them consistently across use cases entering production.

Mentor engineers on risk review practices through paired reviews, documentation, and teaching; ensure knowledge is shared and no capability depends on a single person.

Contribute to defining the strategic direction of the risk engineering program — synthesizing findings from real implementations into roadmap priorities, and producing leadership reporting on risk posture and program outcomes.

About you, you have:

8+ years in security engineering, application security, cloud security, or security architecture, including demonstrated technical leadership of…