Senior Security Risk Analyst — ERM & AI Automation

Plaid; Seattle, Raleigh, San Francisco, New York (WA, NC, CA, NY); On-site; USD 140,000 - 190,000; Full time

Job summary

Plaid is seeking a Security Risk Manager to lead end-to-end risk assessments and help mature the enterprise risk program. You’ll work with engineering teams on access, supply chain, and AI-related risks, delivering quarterly risk reporting and board-ready materials.

You will integrate security risk into enterprise risk management and scale the program with AI-driven automation to improve coverage without increasing headcount.

Qualifications

• Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
• Ability to engage engineers on architecture and controls and distinguish real exposure from hypothetical risk.
• Experience building or maturing a security risk program—methodology, register, treatment and exception workflow, and key risk indicators.
• Experience integrating security risk into an enterprise risk management program.
• Experience preparing quarterly risk reporting and building security risk content for executive and board decks.
• Ability to translate technical risk into concise executive narratives without overstating.
• Knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2 and how risk management feeds each.
• Power user who has built AI skills, agents, or automations that increase risk-program throughput.

Responsibilities

• Run Security Risk Assessments: triage intake, run scenario-based analyses with engineering SMEs, score risk, and drive documented treatment decisions.
• Build Quarterly Risk Reporting: gather updates on material risks, prepare Security Risk Review, and craft content for executive/board decks.
• Integrate Security Risk into ERM: map risks into the enterprise taxonomy and align rating scales.
• Mature the Program: evolve the risk framework, registers, indicators, and owner self-service as scope grows.
• Support FedRAMP 20x Risk Decisions: document risk explanations and secure senior acceptance in the Security Decision Record.
• Scale Through AI and Automation: develop AI-based triage, first-draft analyses, and report automation across the team.

Skills

Security risk assessment

Risk program maturity

ERM integration

Risk reporting

Executive communication

Security & compliance knowledge

AI fluency

Job description

Plaid is seeking a Security Risk Manager to lead end-to-end risk assessments and help mature the enterprise risk program. You’ll work with engineering teams on access, supply chain, and AI-related risks, delivering quarterly risk reporting and board-ready materials.

You will integrate security risk into enterprise risk management and scale the program with AI-driven automation to improve coverage without increasing headcount.