Security GRC Engineer — Lead Compliance & Risk

Whatnot; Los Angeles (CA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health Insurance options

Work From Home Support

Home office setup allowance

Monthly cell phone/internet allowance

Parental leave

401k with employer match

Job summary

Whatnot is seeking an experienced Governance, Risk & Compliance Analyst to join its Security GRC team. You will focus on security governance, risk management, and regulatory compliance across cloud environments and partner ecosystems.

With 5+ years in a tech startup or similar setting, you will help establish security controls, support external audits, and drive the company toward best-practice standards such as ISO 27001, SOC2, PCI, GDPR/CCPA.

Qualifications

• Minimum 5+ years of experience in security governance, risk, and compliance.
• A Bachelor’s degree in Computer Science, Information Security, or a related field.
• Deep knowledge of security best practices and standards (ISO 27001, SOC2, PCI, GDPR/CCPA).
• Experience at a Big 4 firm or equivalent audit firm preferred.
• Proven ability to manage complex third-party audits in cloud environments.

Responsibilities

• Review secure configurations across tools like Okta, Terraform, AWS, Lumos, Cloudflare, and Github.
• Develop security requirements for partner teams and drive compliance progress.
• Prepare for and run external security audits.
• Shape the strategic direction of the Security GRC team.
• Lead the security risk management program balancing risk and business priorities.

Skills

Security governance

Risk management

Compliance

Security controls

Regulatory standards

Education

Bachelor's degree in Computer Science or Information Security

Tools

Okta

Terraform

AWS

Lumos

Cloudflare

Github

Job description

Whatnot is seeking an experienced Governance, Risk & Compliance Analyst to join its Security GRC team. You will focus on security governance, risk management, and regulatory compliance across cloud environments and partner ecosystems.

With 5+ years in a tech startup or similar setting, you will help establish security controls, support external audits, and drive the company toward best-practice standards such as ISO 27001, SOC2, PCI, GDPR/CCPA.