Security GRC: Third-Party Risk Program Lead

VulnU; Northern (KY); Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

Equity

Retirement match

Job summary

Stripe is seeking a Security GRC Program Manager to independently manage a portfolio of third-party security risk assessments. You will review control evidence across questionnaires, reports, and certifications, identify gaps, and drive proportionate remediation.

You will collaborate with Procurement, Legal, Privacy, and other teams to onboard vendors and maintain program health. The role requires strong analytical skills, experience with security frameworks (SOC 2, ISO 27001, PCI DSS, NIST,

Qualifications

• 4+ years of third-party security risk experience.
• End-to-end third-party security assessments experience.
• Knowledge of SOC 2, ISO 27001, PCI DSS, NIST, CSA.
• Clear written and verbal communication skills.

Responsibilities

• Manage a portfolio of TPSRAs for new engagements, renewals, and material scope changes.
• Review security questionnaires, independent assurance reports, certifications, penetration-test results, and other evidence.
• Identify security gaps and determine remediation requirements; communicate findings to stakeholders.
• Document assessment results, decisions, and supporting evidence in program systems.
• Escalate novel, high-risk findings and support due diligence and risk-acceptance processes.
• Partner with Procurement, Legal, Privacy, and business stakeholders to resolve assessment issues.
• Track assessment volume, aging, service levels, and program-health indicators; identify trends and improvements.

Skills

Third-party risk

Security assessments

Information security

SOC 2

ISO 27001

PCI DSS

NIST

CSA

Communication

Project management

Tools

Aravo

Zip

Job description

Stripe is seeking a Security GRC Program Manager to independently manage a portfolio of third-party security risk assessments. You will review control evidence across questionnaires, reports, and certifications, identify gaps, and drive proportionate remediation.

You will collaborate with Procurement, Legal, Privacy, and other teams to onboard vendors and maintain program health. The role requires strong analytical skills, experience with security frameworks (SOC 2, ISO 27001, PCI DSS, NIST,