Program Manager, Security GRC

This is a fully remote position, open to applicants in United States.

📋 Description

• Serve as a subject matter expert in information security during cross-functional audit engagements, representing the Security team in meetings with auditors and regulators.

• Act as the internal liaison (proxy) between the Security organization and other departments to ensure effective and consistent audit management.

• Develop and maintain a centralized repository of audit evidence artifacts necessary for compliance with SOC 2, PCI DSS, SOX, and other global regulatory standards.

• Conduct security risk and control assessments based on established frameworks to ensure alignment with Stripe's Information Security Policy and applicable regulations (e.g., ISO 2700x, PCI DSS, SOX, NIST, COBIT).

• Provide guidance to control owners on the design and redesign of security controls to maintain compliance and effectiveness.

• Facilitate security compliance support for Stripe's legal entities with regulatory obligations, collaborating with cross-functional stakeholders to monitor and report on control remediation initiatives.

• Assist the broader GRC team in program initiatives, which include policy development, security awareness training, and third-party security risk assessments.

⛳️ Requirements

• Expertise in information security frameworks, practices, policies, standards, and procedures (e.g., NIST CSF, SOC 2, PCI DSS, ISO 27001/2, or equivalent).

• Over 6 years of experience in Security Governance, Risk, and Compliance or Technology Compliance roles, with a solid understanding of audit processes.

• Familiarity with global regulatory requirements (e.g., DORA, FFIEC, EBA, NYDFS) and experience in integrating these into compliance programs.

• Proven experience in conducting security audits and supporting compliance efforts across complex and overlapping regulatory frameworks.

• Strong program management capabilities, with a track record of coordinating security assessments and managing multiple stakeholder engagements across various time zones.

• Exceptional communication skills, capable of cultivating relationships at all organizational levels and translating technical security concepts for auditors, regulators, and executive audiences.

🏝️ Benefits

• Health insurance

• Retirement plans

• Paid time off

• Flexible work arrangements

• Professional development