Senior Security Analyst, Security Risk Management
Plaid · Seattle Office
About this role
## Senior Security Analyst — Security Risk Management ### About Plaid Plaid empowers the financial ecosystem by building tools and experiences that thousands of developers use to create products that connect to financial accounts. Plaid powers connections for millions of people and works with companies like Venmo, SoFi, several Fortune 500 companies, and major banks. Plaid’s network covers **12,000+ financial institutions** across the **US, Canada, UK, and Europe**. ### About the Team (Security Governance, Risk, and Compliance — GRC) The **Security Governance, Risk, and Compliance (GRC)** team is part of Plaid’s security organization. The team enables the business by proactively managing information security risks and maintaining effective controls. **Mission:** Reduce the likelihood and impact of security risks while running a robust assurance program that builds trust with customers, consumers, and data partners. ### About the Role You’ll run security risk assessments end-to-end—turning technical concerns into clear, defensible decisions—and help mature Plaid’s security risk program as it scales. **You will: ** - Run **security risk assessments** end-to-end (intake, scenario-based analysis, treatment decisions, and monitoring) across security, infrastructure, and product risk. - Partner with engineering SMEs and risk owners on risks such as **over-privileged access**, **supply-chain gaps**, **product abuse**, and **AI adoption**. - Build **quarterly security risk reporting** for leadership and board materials. - Integrate security risk into **enterprise risk management (ERM)** so it’s tracked alongside other business risks. - Mature the program as scope grows, operating as an **AI power user** to automate work and scale impact. ### Responsibilities - **Run Security Risk Assessments:** Triage intake, perform scenario-based analyses with engineering SMEs, score initial/residual risk, and drive documented treatment decisions. - **Build Quarterly Risk Reporting:** Gather updates on material risks, prepare the Security Risk Review, and create security risk content for executive/board decks. - **Integrate Security Risk into ERM:** Map security risks into the enterprise taxonomy, align rating scales, and keep registers in sync. - **Mature the Program:** Evolve the risk framework, register, key risk indicators, and risk-owner self-service. - **Support FedRAMP 20x Risk Decisions:** Ensure unmet FedRAMP rules and KSI gaps have documented risk explanations and senior-official acceptance in the Security Decision Record. - **Scale Through AI and Automation:** Build AI skills/automations for intake triage, first-draft analyses, register hygiene, and report generation. ### Qualifications **Must haves** - **Security risk assessment experience** running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application/product) using **NIST SP 800-30**, **FAIR**, or comparable methods. - Technical depth to engage engineers on architecture and controls and distinguish real exposure from hypothetical risk. - Experience building/maturing a security risk program (methodology, register, treatment/exception workflow, and key risk indicators). - Experience integrating security risk into an enterprise risk management program. - Experience preparing quarterly risk reporting and executive/board deck content. - Ability to translate technical risk into concise executive narratives. - Working knowledge of **NIST 800-53**, **NIST CSF*
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.