GRC Risk & Compliance Manager | Equity & Impact

WHOOP; Boston (MA); On-site; USD 155,000 - 195,000; Full time

Job summary

WHOOP in Boston seeks a Manager of Governance, Risk, and Compliance to lead the day-to-day GRC operations in a fast-growing environment. You will collaborate with Legal, Security, Product, and other teams to advance compliance, reduce enterprise risk, and strengthen resilience.

You will own risk assessments, third‑party due diligence, policy management, and KPI reporting, while guiding a team and ensuring SSDLC controls align with frameworks such as ISO 27001, SOC 2, NIST CSF, and HIPAA.

Qualifications

• 8+ years of experience in GRC, information security, cybersecurity; with 2+ years of experience leading or managing GRC, information security, or audit professionals.
• Demonstrated experience leading operational GRC programs, including intake management, workload prioritization, KPI reporting, and cross-functional coordination.
• Extensive hands‑on experience performing third‑party/vendor risk assessments, security reviews, due diligence, and risk‑based decision support.
• Strong knowledge of SSDLC risk assessments and application security governance processes.
• Deep knowledge of security and privacy frameworks and regulations, including ISO 27001, SOC 2, NIST CSF, HIPAA, GDPR, PCI DSS, and modern cybersecurity risk management practices.
• Excellent written and verbal communication skills, with the ability to communicate effectively with technical teams, business stakeholders, auditors, and executive leadership
• A minimum bachelor’s degree in any discipline. Computer science, cybersecurity, and risk or technology degrees preferred.

Responsibilities

• Lead the day-to-day operations of the GRC function, ensuring timely execution of governance, risk, compliance, third‑party risk, and secure development lifecycle (SSDLC) assessment activities.
• Lead enterprise risk reviews by driving GRC intake and request triage, personally overseeing complex assessments while prioritizing and delegating work across the team.
• Perform and lead the third‑party risk management lifecycle by conducting and overseeing vendor risk assessments and due diligence in partnership with Legal, IT, and Security.
• Manage team workload and capacity by assigning, tracking, and escalating requests as needed to ensure consistent delivery, quality, and stakeholder satisfaction.
• Develop and report operational metrics and KPIs, providing weekly dashboards and status updates to GRC leadership.
• Contribute directly to governance activities, including policy management, control assessments, evidence collection, audit support, and continuous compliance initiatives.
• Maintain the enterprise risk register by documenting, tracking, escalating, and reporting technology, cybersecurity, privacy, and third‑party risks
• Support security incident response activities by coordinating compliance‑related obligations, regulatory documentation, and risk remediation tracking.

Skills

GRC Leadership

Risk Assessment

Regulatory Knowledge

Vendor Risk

SSDLC

Education

Bachelor's degree

Job description

WHOOP in Boston seeks a Manager of Governance, Risk, and Compliance to lead the day-to-day GRC operations in a fast-growing environment. You will collaborate with Legal, Security, Product, and other teams to advance compliance, reduce enterprise risk, and strengthen resilience.

You will own risk assessments, third‑party due diligence, policy management, and KPI reporting, while guiding a team and ensuring SSDLC controls align with frameworks such as ISO 27001, SOC 2, NIST CSF, and HIPAA.