Senior Security Analyst, Security Risk Management

Plaid; Seattle (WA); Hybrid; USD 156.000 - 214.000; Vollzeit

Benefits dieser Stelle

Medical, Dental, Vision

401(k)

Equity/Commission

Zusammenfassung

Plaid is hiring a Senior Security Analyst to strengthen security risk management within the GRC program. This role runs end-to-end risk assessments and turns findings into clear reporting for leadership and the board.

As part of the GRC team, you will reduce risk through a robust assurance approach, partnering across the company to keep Plaid secure, resilient, and aligned with industry and regulatory expectations. Hybrid Seattle location.

Qualifikationen

• Experience running scenario-based analyses of technical risks using NIST SP 800-30, FAIR, or similar methods.
• Ability to translate risk into concise executive narrative for leadership and board.
• Experience maturing a security risk program with methodology, risk register, and indicators.
• Proven track record integrating security risk into enterprise risk management.
• Experience presenting quarterly risk reports for executives and board decks.
• Strong knowledge of NIST 800-53, NIST CSF, ISO 27001, SOC 2.
• Hands-on FedRAMP 20x with SDR reporting.

Aufgaben

• Run end-to-end security risk assessments within Plaid's risk management program.
• Collaborate with engineering SMEs and risk owners on identified risks.
• Build quarterly risk reports and content for leadership and board materials.
• Integrate security risk into the enterprise risk management program.
• Support program maturity and automate parts of the workflow as an AI power user.
• Triaging intake, scoring risks, and driving documented treatment decisions.
• Prepare Security Risk Review updates and executive/deck content.
• Map security risks into the enterprise taxonomy and align risk registers.
• Help evolve the risk framework, registers, KPIs, and owner self-service.
• Ensure unmet FedRAMP/KSI gaps have documented risk explanations and approvals.
• Develop AI skills and automations for risk analyses and report generation.

Kenntnisse

Risk assessment

Executive storytelling

Enterprise risk management

AI automation

Federally compliant risk experience

Ausbildung

Bachelor level preferred

Tools

NIST SP 800-30

NIST 800-53

NIST CSF

ISO 27001

SOC 2

FedRAMP 20x

Security Decision Record (SDR)

Jobbeschreibung

Plaid is hiring a Senior Security Analyst to strengthen security risk management within the Security Governance, Risk, and Compliance (GRC) program. This role runs end-to-end security risk assessments and turns findings into clear, defensible reporting that leadership and the board can use to make informed security trade-offs.

As part of the GRC team, you will help reduce the likelihood and impact of security risks through a robust assurance approach, partnering across the company to keep Plaid's platform secure, resilient, and aligned with industry and regulatory expectations.

What you’ll do

• Run security risk assessments end-to-end within Plaid's security risk management program, including intake, scenario-based analysis, treatment decisions, and monitoring across security, infrastructure, and product risk.
• Collaborate with engineering SMEs and risk owners on risks such as over-privileged access and supply-chain gaps, as well as product abuse and AI adoption, providing owners a clear basis to accept or mitigate each risk.
• Build quarterly security risk reporting and develop security risk content for leadership and board materials.
• Integrate security risk into Plaid's enterprise risk management program so security risk is tracked and weighed alongside broader business risks.
• Support program maturity as scope grows, operating as an AI power user who automates parts of the workflow to help the program scale.
• Triage intake, conduct scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision.
• Collect updates on material risks, prepare the Security Risk Review, and build security risk content for executive and board decks.
• Partner with enterprise risk stakeholders to map security risks into the enterprise taxonomy, align rating scales, and keep registers synchronized.
• Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program expands.
• Ensure unmet FedRAMP rules and KSI gaps include a documented risk explanation and senior-official acceptance in the Security Decision Record, consistent with the risk register.
• Build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation, and share learnings with the team.

Requirements

• Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
• Technical depth to engage engineers on architecture and controls, with the ability to distinguish real exposure from hypothetical risk.
• Experience building or maturing a security risk program, including methodology, register, treatment and exception workflow, and key risk indicators.
• Experience integrating security risk into an enterprise risk management program.
• Experience preparing quarterly risk reporting and developing security risk content for executive and board decks.
• Ability to translate technical risk into a concise executive narrative without overstating or hand-waving.
• Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each.
• Power user who has built AI skills, agents, or automations that materially increase risk-program throughput and shares what works with the team.
• Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI).

Tools and frameworks

• NIST SP 800-30, FAIR
• NIST 800-53, NIST CSF, ISO 27001, SOC 2
• FedRAMP 20x
• Security Decision Record, SDR-CSO-FRR, SDR-CSX-KSI

Compensation and benefits

• Salary: USD 156,000 - 213,600 per year
• Additional compensation in the form(s) of equity and/or commission (dependent on the position offered)
• Medical, Dental, Vision
• 401(k)
• Pay is based on factors including scope and responsibilities, work experience and skillset, and location; pay and benefits are subject to change.

Location and employment

• Seattle, WA (hybrid)
• Seattle Office; New York City Office; Raleigh Office; San Francisco HQ
• Address: 1000 Dexter Avenue North, Suite 100A, Seattle, Washington, 98109
• Full time
• Department: All Departments - Risk - Eng