Senior GRC Leader: Strategy, Risk & Compliance + Equity

WHOOP; Boston (MA); On-site; USD 185,000 - 205,000; Full time

Benefits offered by this job

Equity

Benefits package

Job summary

WHOOP, based in Boston, MA, seeks a Senior Manager GRC to lead governance, risk, and compliance in a high-growth tech setting. You will shape the security roadmap with Product, Engineering, Data Analytics, and Legal, driving risk-based decisions across the organization.

This role requires deep expertise in ISO 27001, SOC 2, GDPR, PCI, and NIST CSF, with a history of scaling GRC programs, mentoring analysts, and delivering executive-level risk reporting.

Qualifications

• 10+ years of experience in GRC or information security.
• 5+ years managing GRC or security professionals.
• Experience with ISO 27001, SOC 2, GDPR, PCI, NIST CSF.
• Experience building or integrating GRC programs in enterprise security.
• Excellent communication and leadership skills.
• Bachelor's degree in any discipline; CS/cybersecurity/risk/tech preferred.

Responsibilities

• Lead development and evolution of the GRC program, driving strategy and execution.
• Develop and manage scalable security control frameworks, policies, and awareness programs.
• Support incident response and translate into improvements across the risk and compliance program.
• Manage enterprise risk register and deliver executive reporting.
• Mentor GRC analysts and scale the program with hands-on execution.
• Evaluate and improve GRC tools, processes, and metrics.

Skills

GRC leadership

Risk management

Regulatory compliance

Communication & leadership

Education

Bachelor's degree

Tech/cybersecurity degree preferred

Job description

WHOOP, based in Boston, MA, seeks a Senior Manager GRC to lead governance, risk, and compliance in a high-growth tech setting. You will shape the security roadmap with Product, Engineering, Data Analytics, and Legal, driving risk-based decisions across the organization.

This role requires deep expertise in ISO 27001, SOC 2, GDPR, PCI, and NIST CSF, with a history of scaling GRC programs, mentoring analysts, and delivering executive-level risk reporting.