Security Engineer (GRC)

Whatnot Inc.; San Francisco (CA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Generous Holiday and Time off Policy

Health Insurance options: Medical, D.D

Work From Home Support

Home office setup allowance

Monthly cell phone and internet

Wellness allowance

Annual childcare allowance

Family planning benefits

401k with employer match up to 4%

Dogfood budget

Parental Leave

Job summary

Whatnot's Security GRC team defends user data and demonstrates regulatory commitment. The Governance, Risk, & Compliance Analyst role focuses on building security maturity, defining requirements for partners, and leading risk management initiatives across a cloud-centric environment.

You will collaborate with product and business leaders, support external audits, and help shape the security program's direction while ensuring alignment with ISO 27001, SOC2, PCI, GDPR/CCPA standards.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.

Responsibilities

• Review secure configurations across tools like Okta, Terraform, AWS, Lumos, Cloudflare, and Github.
• Develop security requirements for partner teams and drive execution of those requirements.
• Prepare for and run external security audits.
• Shape the strategic direction of the Security GRC team.
• Lead the security risk management program to prioritize risks and ensure mitigations.

Skills

Security governance

Risk management

Compliance

Audit support

Security controls

Written communication

Cloud security

Education

Bachelor's degree in CS/InfoSec

Tools

Okta

Terraform

AWS

Lumos

Cloudflare

Github

Job description

Join the Future of Commerce with Whatnot!

Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.

As a remote co-located team, we're inspired by our values and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.

We're one of the fastest growing marketplaces and were recently named the #1 Best Startup Employer in America by Forbes. Check out the latest Whatnot updates on our news and engineering blogs and join us as we enable anyone to turn their passion into a business and bring people together through commerce.

Role

Whatnot's Security GRC team is dedicated to building trust with regulators, customers, employees, and investors by demonstrating commitment to industry standards and continuous improvement. We defend and protect our users' data and information as if it were our own. As part of the Security GRC team, you can expect to be responsible for:

• Reviewing and implementing secure configurations across various tools like Okta, Terraform, AWS, Lumos, Cloudflare, and Github.

• Developing security requirements for partner teams and driving progress towards the execution of those requirements.

• Preparing for and running our external security audits.

• Shaping the strategic direction of the Security GRC team.

• Leading our security risk management program to prioritize security risks and ensure proper mitigations are implemented.

Team members in this role are required to be within commuting distance of our Los Angeles, CA, San Francisco, CA, Seattle, WA or New York, NY hubs.

You

Curious about who thrives at Whatnot? We’ve found that low ego, a growth mindset, and leaning into action and high impact goes a long way here.

As our Governance, Risk, & Compliance Analyst you should have a minimum of 5+ years of relevant experience in security governance, risk, and compliance, preferably in a tech startup environment, plus:

• A Bachelor’s degree in Computer Science, Information Security, or a related field.

• The successful candidate will have a deep knowledge of security best practices and industry standards, such as ISO 27001, SOC2, PCI, and GDPR/ CCPA.

• Experience at a Big 4 firm or similar reputable audit firm.

• Experience in supporting complex third party audit projects in a cloud centric environment, with a strong aptitude to understand emerging technologies to ensure regulatory and compliance requirements are met.

• Excellent written communication skills with the ability to document, communicate, and report security assessments as well as the status of the implementation and effectiveness of cybersecurity controls with product and business leaders.

• Experience creating and running a security risk management program that adeptly balances security risks with business priorities.

Benefits

• Generous Holiday and Time off Policy

• Health Insurance options including Medical, Dental, Vision

• Work From Home Support

  • Home office setup allowance

  • Monthly allowance for cell phone and internet

• Care benefits

  • Monthly allowance for wellness

  • Annual allowance towards Childcare

  • Lifetime benefit for family planning, such as adoption or fertility expenses

• Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally

• Monthly allowance to dogfood the app

  • All Whatnauts are expected to develop a deep understanding of our product. We're passionate about building the best user experience, and all employees are expected to use Whatnot as both a buyer and a seller as part of their job (our dogfooding budget makes this fun and easy!).

• Parental Leave

  • 16 weeks of paid parental leave + one month gradual return to work *company leave allowances run concurrently with country leave requirements which take precedence.

Please note: Whatnot will only contact you through official @whatnot.com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.

EOE

Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law. We believe that our work is better and our company culture is improved when we encourage, support, and respect the different skills and experiences represented within our workforce.