Security GRC Program Manager, Third Party at Stripe

Worldwide

$131.2k - $196.8k

<h2><strong>Who we are</strong></h2> <h3><strong>About Stripe</strong></h3> <p>Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.</p> <h3><strong>About the team</strong></h3> <p>The Stripe Security team is dedicated to improving the security of Stripe and its users. Our users trust us with some of their most sensitive information, and we make security a first-class consideration in everything we do. Security concerns are ever-evolving, creating an extremely dynamic environment for the Security team.</p> <p>The goal of the Security GRC team at Stripe is to provide information security advice and operational structure to the Security organization and its customers, both internal and external to Stripe. The team is responsible for various functional areas, including Security Governance, Risk, Compliance, Go-To-Market security support, Security Awareness, and Third Party Security Risk Assessment (TPSRA). </p> <p>The Security GRC Program Manager position will be part of Stripe’s CISO pillar and will have the ability to influence the continuous buildout of the Third Party Security Risk Assessment (TPSRA) program including developing policies, standards and processes to support the program.</p> <h3>You Will:</h3> <ul> <li>Support the Third Party Security Risk Assessment (TPSRA) program operations, including creating awareness amongst the Stripe community,.</li> <li>Support the completion of the information security review process for all new third parties and annual reviews for all other relationships that receive and/or interact with Stripe data.</li> <li>Function as the Third Party Security Risk management subject matter expert supporting cross-functional teams looking to onboard third parties in processes that interact with Stripe’s data.</li> <li>Contribute to security policies and standards for assessing Third Party Security Risk.</li> <li>Identify Third Party Security Risk program gaps and drive the implementation of recommended mitigations.</li> <li>Partner with cross-functional stakeholders to identify, analyze and mitigate Third Party Security Risks associated with outsourced activities and products.</li> <li>Operate autonomously leading assessments, and working on large-scale efforts across multiple teams and functions, with stakeholders across different time zones.</li> <li>Contribute to formalizing and streamlining the Third Party Security Risk program processes to improve SLAs and provide better customer service.</li> <li>Report on the program’s health and success metrics to provide insights to management to help drive strategic direction.</li> </ul> <h3>What You'll Need:</h3> <ul> <li>Minimum of 4 years of experience in a third party security risk role</li> <li>Strong background in third party security risk operations</li> <li>Strong understanding of enterprise security principles, third party risk management, and compliance/industry best practices</li> <li>Experience in the end-to-end management, implementation, and execution of third-party security risk assessment methodologies and processes</li> <li>Strong analytical skills to support assessment of risk and appropriate course of action</li> <li>You have strong written and verbal communication skills, building strong relationships at all levels of the organization from executives to project teams</li> <li>Knowledge of how to use data to influence program strategy and tell compelling stories about organizational effectiveness and impact</li> </ul> <h3>Bonus Points:</h3> <ul> <li>Report on program performance via dashboards, OKRs and perform basic data analysis (e.g., Tableau)</li> <li>Experience working with JIRA, Zip, etc.</li> <li>Experience working with engineers for the automation of security controls</li> </ul> <h2> Working remotely at Stripe </h2> A remote location is defined as being 35 miles (56 kilometers) or more from one of our offices. While you would be welcome to come into the office for team/business meetings, on-sites, meet-ups, and events, our expectation is you would regularly work from home rather than a Stripe office. Stripe does not cover the cost of relocating to a remote location. We encourage you to apply for roles that match the location where you currently live or plan to live. <h2> Pay and benefits </h2> <p> The annual US base salary range for this role is $131,200 - $196,800. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. This salary range may be inclusive of several career levels at Stripe and will be narrowed during the interview process based on a number of factors, including the candidate’s experience, qualifications, and location. Applicants interested in this role and who are not located in the US may request the annual salary range for their location during the interview process. </p> <p>Additional benefits for this role may include: equity, company bonus or sales commissions/bonuses; 401(k) plan; medical, dental, and vision benefits; and wellness stipends.</p> <h2> We look forward to hearing from you </h2> At Stripe, we're looking for people with passion, grit, and integrity. You're encouraged to apply even if your experience doesn't precisely match the job description. Your skills and passion will stand out—and set you apart—especially if your career has taken some extraordinary twists and turns. At Stripe, we welcome diverse perspectives and people who think rigorously and aren't afraid to challenge assumptions. Join us.