Security Risk Governance Analyst: Drive Risk & Compliance

RiseMe; San Francisco (CA); On-site; USD 105,000 - 145,000; Full time

Benefits offered by this job

Bonus

Equity package

Benefits

Job summary

Chime is seeking a Security Risk Governance Analyst to strengthen how risk is identified, assessed, and managed across third-party ecosystems and internal controls. You’ll collaborate with Security, Risk, Compliance, Engineering, and Infra Security to drive assessments to completion and build repeatable processes.

You’ll run vendor reviews, support SOX/PCI/SOC 2/ISO 27001 programs, and develop security training content while tracking findings and remediation in the SRG risk register.

Qualifications

• 2–4 years of experience in security, IT audit, risk, or compliance in a regulated environment.
• Hands-on experience with third-party security reviews, risk assessments, or controls testing.
• Experience in information security, risk, and security program management.
• Familiarity with vulnerability management tooling and risk exception lifecycle.
• Knowledge of SOX, SOC 2, NIST 800-series / NIST CSF, ISO 27001, PCI DSS.
• Experience documenting procedures, processes, and runbooks.

Responsibilities

• Run third-party security reviews end to end: due diligence, evidence, interviews, monitoring.
• Support SOX ITGC, PCI DSS, SOC 2, ISO 27001 programs with audit prep and evidence.
• Conduct risk analyses, gap analyses, control testing, and document findings.
• Run quarterly user access reviews and manage evidence in ConductorOne.
• Define and maintain security KPIs, KRIs, and dashboards for leadership visibility.
• Develop or source security training content and deliver via LMS.
• Create and maintain runbooks, baselines, and standards with SRG engineering.
• Move Security Architecture Reviews through the process with cross-team collaboration.

Skills

Security risk management

Vendor security reviews

Risk assessments

Controls testing

Audit and compliance

Education

Bachelor's degree in a related field

Tools

ConductorOne

AWS

GitHub

GCP

Job description

Chime is seeking a Security Risk Governance Analyst to strengthen how risk is identified, assessed, and managed across third-party ecosystems and internal controls. You’ll collaborate with Security, Risk, Compliance, Engineering, and Infra Security to drive assessments to completion and build repeatable processes.

You’ll run vendor reviews, support SOX/PCI/SOC 2/ISO 27001 programs, and develop security training content while tracking findings and remediation in the SRG risk register.