Security GRC Engineer: Risk, Audits and Compliance

Whatnot; San Francisco (CA); On-site; USD 175,000 - 230,000; Full time

Benefits offered by this job

Health Insurance

Home office setup allowance

Cell phone and internet allowance

Wellness stipend

Childcare allowance

Family planning allowance

401k with company match

Pension plans internationally

Parental leave (16 weeks)

Job summary

Whatnot is seeking a Governance, Risk, & Compliance Analyst to strengthen security governance, risk management, and regulatory compliance across the organization. You will help shape security controls, partner with teams, and support external audits to protect user data and trust.

As part of a remote co-located team with hubs in Los Angeles, San Francisco, Seattle, and New York, you will drive security requirements, manage third-party audits, and guide the strategic direction of the GRC

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• Deep knowledge of security best practices and industry standards such as ISO 27001, SOC2, PCI, and GDPR/ CCPA.
• Experience at a Big 4 firm or similar reputable audit firm.
• Experience in supporting complex third party audit projects in a cloud centric environment, with a strong aptitude to understand emerging technologies to ensure regulatory and compliance requirements are met.
• Excellent written communication skills with the ability to document, communicate, and report security assessments as well as the status of the implementation and effectiveness of cybersecurity controls with product and business leaders.
• Experience creating and running a security risk management program that adeptly balances security risks with business priorities.

Responsibilities

• Reviewing and implementing secure configurations across tools like Okta, Terraform, AWS, Lumos, Cloudflare, and Github.
• Developing security requirements for partner teams and driving progress towards the execution of those requirements.
• Preparing for and running our external security audits.
• Shaping the strategic direction of the Security GRC team.
• Leading our security risk management program to prioritize security risks and ensure proper mitigations are implemented.

Skills

Security governance

Risk management

Compliance

ISO 27001

SOC 2

PCI DSS

Data privacy

Audit support

Technical writing

Cloud security

Education

Bachelor’s degree in CS/InfoSec

Job description

Whatnot is seeking a Governance, Risk, & Compliance Analyst to strengthen security governance, risk management, and regulatory compliance across the organization. You will help shape security controls, partner with teams, and support external audits to protect user data and trust.

As part of a remote co-located team with hubs in Los Angeles, San Francisco, Seattle, and New York, you will drive security requirements, manage third-party audits, and guide the strategic direction of the GRC