GRC Security Analyst: Risk, Policy & Audit Lead

Pinterest; United States; Hybrid; USD 124,000 - 255,000; Full time

Job summary

Pinterest is seeking an IC14 Security Engineer - Security Governance, Risk & Compliance to strengthen governance and assurance programs. You will partner with Security, Engineering, IT, Legal, Internal Audit and cross-functional teams to maintain and improve the security control environment.

The role covers risk management, policy governance, control testing, audit support, and awareness tracking, with opportunities to influence security maturity and process improvements at scale.

Qualifications

• 4+ years of experience in security governance, risk, compliance, audit, or security assurance roles.
• Working knowledge of SOC 2, CIS Controls, ISO 27001, NIST CSF or similar.
• Experience supporting audits, assessments, or control testing in a technology/SaaS environment.
• Ability to write clear, practical security policies, standards, and procedures.
• Experience maintaining risk registers and supporting formal risk assessment processes.

Responsibilities

• Administer and maintain the security risk register with updates, owners, and reports.
• Partner with stakeholders to identify, document, assess, and monitor security risks.
• Draft, review, update, and manage the lifecycle of security policies and standards.
• Support SOC 2 Type 2 audit planning, evidence collection, and follow-up.
• Track security awareness training metrics and remediation actions.
• Execute control testing aligned to CIS Controls and document findings and remediation.

Skills

Security governance

Risk assessment

Policy writing

Audit support

Documentation

Cross-functional collaboration

Communication

Attention to detail

Strategic thinking

Education

Bachelor's degree in Computer Information Systems or Cybersecurity

Equivalent experience

Tools

SOC 2

CIS Controls

ISO 27001

NIST CSF

Job description

Pinterest is seeking an IC14 Security Engineer - Security Governance, Risk & Compliance to strengthen governance and assurance programs. You will partner with Security, Engineering, IT, Legal, Internal Audit and cross-functional teams to maintain and improve the security control environment.

The role covers risk management, policy governance, control testing, audit support, and awareness tracking, with opportunities to influence security maturity and process improvements at scale.