Cyber Risk Lead

About Nscale Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility. We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future. About the Role We’re hiring a Cyber Risk Lead to own enterprise-wide cyber security risk across Nscale’s global AI infrastructure and build the risk function from the ground up. This senior individual contributor role sits at the intersection of risk management, statistical analysis, engineering, and governance. You’ll own the cyber risk register, risk treatment, and remediation governance, partnering with control and system owners who execute fixes, the compliance engineering function that provides continuous monitoring, and the enterprise risk team that represents cyber exposure within Nscale’s broader enterprise risk register. We approach risk as an engineering problem. You’ll create a dynamic, threat-informed cyber risk program that turns technical telemetry into measured insights and scalable treatment plans, defining how cyber risk is quantified, prioritized, and reduced as Nscale grows. What you'll be doing Cyber Risk Engineering & Modeling Build and operate Nscale’s continuously measured cyber risk program, transforming technical telemetry into actionable risk insights. Develop and maintain a dynamic cyber risk model that reflects asset exposure across technology, data centers, and software supply chains. Model realistic attack scenarios using threat intelligence, adversary TTPs, historical incidents, and attack path analysis to prioritize risks by likelihood and loss magnitude. Quantify cyber risk using recognized methodologies such as FAIR, NIST SP 800-30, or ISO 27005, adapting them to support engineering decisions rather than compliance reporting. Risk Treatment & Execution Own the cyber risk treatment lifecycle, translating prioritized risks into actionable engineering work with clear ownership, measurable objectives, and expected risk reduction. Establish measurable risk treatment objectives and engineering service levels. Validate that remediation activities produce demonstrable reductions in cyber risk. Align cyber risk with enterprise risk management through shared taxonomies, scoring models, and reporting that accurately represent enterprise exposure. Issue Management & Remediation Governance Establish engineering service levels, escalation paths, and governance that drive timely remediation while balancing operational and business priorities. Hold remediation owners accountable for closing risks within agreed service levels. Validate completed remediation through technical evidence rather than administrative closure. Maintain the cyber risk register and closure discipline while control owners resolve identified gaps. Risk Automation & Continuous Posture Integrate risk into the compliance-as-code platform so posture is continuous and evidence-backed. Apply risk-as-code where it materially improves risk and issue management. Improve the fidelity of cyber risk measurements through engineering automation, analytics, and new data sources. Connect risk, vulnerability, asset, GRC, and engineering workflow data to reduce manual effort and improve visibility. Program Development & Reporting Report material enterprise risk scenarios using defensible logic and clear, articulate presentations. Provide leadership with measured insights into Nscale’s cyber risk posture and treatment progress. Help shape the broader GRC program architecture as it grows. KPIs Risk register completeness, evidence freshness, and continuous coverage Remediation service-level attainment and reduction in overdue issues High-risk remediation completed within engineering service levels Risks continuously assessed through technical telemetry About You 8+ years of experience in enterprise security risk management, including building or running a risk register and treatment program. Risk quantification and treatment expertise grounded in a recognized method such as the NIST Cybersecurity Framework, ISO 27005, or FAIR. A track record of driving remediation across engineering teams, not simply logging issues. Comfort working directly with risk data using SQL, scripting, or equivalent tooling to pull and trend risk, vulnerability, and asset data. Experience building risk tooling or automation, including integrations between scanners, asset inventories, GRC platforms, and engineering issue trackers. Ability to use automation and AI-assisted workflows to reduce manual GRC work. Strong understanding of cloud infrastructure and security controls, including the ability to read infrastructure-as-code such as Terraform well enough to assess whether a control is effective. Experience with automation-first risk management, continuous control monitoring, or actuarial approaches to risk modeling. Experience with AI infrastructure, hyperscale, regulated environments, critical infrastructure, data center operations, or sovereign cloud requirements. Relevant certifications such as CISSP or CRISC, and a strong statistics or mathematics background, are advantageous. What we can offer you At Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impa