Third-Party Security Risk & GRC Program Lead

Stripe; United States; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Stripe Security Governance, Risk, and Compliance (SGRC) leads third-party risk assessments to ensure vendor controls meet Stripe standards. You will manage complex TPSRAs, review security evidence, and guide remediation while coordinating with Procurement, Legal, Privacy, and product teams.

Ideal candidates have 4+ years in third-party security risk, strong communication, and experience applying SOC 2, ISO 27001, PCI DSS, and NIST frameworks to assess and improve vendor controls.

Qualifications

• 4+ years in third-party security risk or related risk-management.
• Experience conducting end-to-end third-party security assessments.
• Knowledge of SOC 2, ISO 27001, PCI DSS, NIST, CSA.
• Ability to manage multiple assessments and stakeholders.
• Strong written and verbal communication.
• Experience using data to identify trends and improve processes.
• Collaborative with cross-functional teams.

Responsibilities

• Manage a portfolio of TPSRAs for new engagements, renewals, and scope changes.
• Review security questionnaires and reports to evaluate controls.
• Identify gaps and communicate remediation requirements.
• Document assessment results and evidence in program systems.
• Escalate high-risk findings and support due diligence and risk acceptance.
• Partner with Procurement, Legal, Privacy, and business teams to resolve issues.
• Provide guidance to Stripe teams on TPSRA requirements and timelines.
• Track volume, aging, service levels, and program health indicators.
• Identify gaps and contribute to process improvements.
• Contribute to third-party risk policies and guidance.

Skills

Third-party risk

Security assessments

Security frameworks

Communication

Project management

Tools

Aravo

Zip

Job description

Stripe Security Governance, Risk, and Compliance (SGRC) leads third-party risk assessments to ensure vendor controls meet Stripe standards. You will manage complex TPSRAs, review security evidence, and guide remediation while coordinating with Procurement, Legal, Privacy, and product teams.

Ideal candidates have 4+ years in third-party security risk, strong communication, and experience applying SOC 2, ISO 27001, PCI DSS, and NIST frameworks to assess and improve vendor controls.