Senior Security Governance & AI Risk Engineer

Klaviyo; Boston (MA); On-site; USD 156,000 - 234,000; Full time

Job summary

Klaviyo seeks a Lead Security Governance & Risk Engineer to own risk decisions, automate risk reporting, and drive ISO 42001 readiness. You’ll quantify cyber and vendor risks, integrate with AI governance, and partner with Engineering, Legal, and Finance to make risk visible and actionable.

You will report to the Senior Manager, Security Risk Engineering and operate as a second line of defense, building scalable risk controls and dashboards for leadership.

Qualifications

• 7+ years of information security, technology risk, cyber risk, or operational risk in a large, complex org.
• Strong ability to express risk in financial terms (FAIR or similar).
• Hands‑on engineering ability: SQL, Python, and API integrations for data automation.
• Experience building/maintaining risk registers and taxonomy with tooling and automation.

Responsibilities

• Operate and maintain the risk register and taxonomy across the org.
• Lead AI risk governance and ISO 42001 readiness with defined risk treatment plans.
• Drive third‑party risk automation and risk scoring with cross‑functional partners.
• Perform hands‑on risk quantification to inform leadership decisions.
• Support risk governance cadence with timely, decision‑ready materials.
• Act as second line of defense with independent oversight and credible challenge.
• Collaborate with Engineering, Product, Legal, Internal Audit, and Finance on findings.

Skills

SQL

Python

APIs

Tools

Third‑party risk platforms

Cyber risk quantification

Vulnerability management

Endpoint & data-security telemetry

Job description

Klaviyo seeks a Lead Security Governance & Risk Engineer to own risk decisions, automate risk reporting, and drive ISO 42001 readiness. You’ll quantify cyber and vendor risks, integrate with AI governance, and partner with Engineering, Legal, and Finance to make risk visible and actionable.

You will report to the Senior Manager, Security Risk Engineering and operate as a second line of defense, building scalable risk controls and dashboards for leadership.