Senior Security Risk Analyst - AI-Driven GRC & ERM

Speedrun Talent Network; Seattle, Northern (WA, KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Plaid's Security Governance, Risk, and Compliance (GRC) team protects the business by proactively managing information security risks and maintaining effective controls across security, infrastructure, and product risk.

The role leads end-to-end risk assessments, collaborates with engineering and risk owners, builds quarterly security risk reporting for executives and the board, and helps mature ERM integration while leveraging AI to scale the program.

Qualifications

• Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
• Ability to engage engineers on architecture and controls, and to distinguish real exposure from hypothetical concerns.
• Experience building or maturing a security risk program—methodology, register, treatment and exception workflow, and key risk indicators.
• Experience integrating security risk into an enterprise risk management program.
• Experience preparing quarterly risk reporting and building security risk content for executive and board decks.
• Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2; understanding how risk management feeds each.
• Power user who has built AI skills, agents, or automations that materially increase risk-program throughput.

Responsibilities

• Run Security Risk Assessments: Triage intake, run scenario-based risk analyses with engineering SMEs, score initial and residual risk, drive risk owners to documented treatment decisions.
• Build Quarterly Risk Reporting: Gather updates on material risks, prepare the Security Risk Review, and build the security risk content for executive and board decks.
• Integrate Security Risk into ERM: Partner with enterprise risk stakeholders to map risks into the enterprise taxonomy and align rating scales.
• Mature the Program: Help evolve the risk framework, registers, KRIs, and risk-owner self-service as the program grows.
• Support FedRAMP 20x Risk Decisions: Ensure FedRAMP rules and KSI gaps have documented risk explanations and senior-official acceptance in the Security Decision Record.
• Scale Through AI and Automation: Develop AI-driven intake triage, first-draft risk analyses, and automated reporting to broaden coverage without headcount growth.

Skills

Security risk assessment

ERM integration

Risk reporting

Security compliance

AI tooling

Job description

Plaid's Security Governance, Risk, and Compliance (GRC) team protects the business by proactively managing information security risks and maintaining effective controls across security, infrastructure, and product risk.

The role leads end-to-end risk assessments, collaborates with engineering and risk owners, builds quarterly security risk reporting for executives and the board, and helps mature ERM integration while leveraging AI to scale the program.