Security Risk Governance Specialist

Chime; San Francisco (CA); On-site; USD 105,000 - 145,000; Full time

Benefits offered by this job

Bonus

Equity

Job summary

Chime is hiring a Security Risk Governance Analyst to strengthen how we identify, assess, and manage risk across our third-party ecosystem and internal controls. You will collaborate with Security, Risk, Compliance, Engineering, and Infra Security to close gaps and move assessments to closure.

The role advances through vendor reviews, risk assessments, and controls testing, with opportunities to contribute to SOX, PCI DSS, SOC 2, and ISO 27001 programs.

Qualifications

• 2-4 years of experience in security, IT audit, risk, or compliance, or equivalent in a regulated environment.
• Hands-on experience with third-party security reviews, risk assessments, or controls testing.
• Experience with information security, security risk, and/or security program management.
• Familiarity with security frameworks such as SOX, SOC 2, NIST, ISO 27001, PCI DSS.
• Experience documenting security procedures, processes, standards, and runbooks.

Responsibilities

• Run third‑party security reviews end to end: due diligence, evidence collection, vendor interviews, and monitoring.
• Support SOX ITGC, PCI DSS, SOC 2, and ISO 27001 programs with audit prep and coordination.
• Conduct risk assessments, gap analyses, and controls testing; document findings and track remediation.
• Run quarterly user access reviews for applicable frameworks; manage builds, revocation, and evidence retention.
• Define and maintain security KPIs, KRIs, and leadership dashboards.

Skills

Security risk

Third-party reviews

Risk assessments

Controls testing

SOX

SOC 2

ISO 27001

Tools

ConductorOne

Vulnerability management tools

Job description

Chime is hiring a Security Risk Governance Analyst to strengthen how we identify, assess, and manage risk across our third-party ecosystem and internal controls. You will collaborate with Security, Risk, Compliance, Engineering, and Infra Security to close gaps and move assessments to closure.

The role advances through vendor reviews, risk assessments, and controls testing, with opportunities to contribute to SOX, PCI DSS, SOC 2, and ISO 27001 programs.