# Senior Security Analyst, Security Risk Management

**Company**: Plaid
**Location**: Seattle Office; New York City Office; Raleigh Office; San Francisco HQ
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $156K – $213.6K
**Category**: Security
**Industry**: Technology

**Apply**: https://jobs.ashbyhq.com/plaid/4c4af954-2c70-4a3c-acc2-97c58211f920?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_0565f201-2d7

## Description

We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products.

**About the team:** The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls.

**About the role:** You will run security risk assessments end-to-end within Plaid’s security risk management program,intake, scenario-based analysis, treatment decisions, and monitoring across security, infrastructure, and product risk.

**Responsibilities:**

- Run Security Risk Assessments: Triage intake, run scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision.

- Build Quarterly Risk Reporting: Gather updates on material risks, prepare the Security Risk Review, and build the security risk content for executive and board decks.

- Integrate Security Risk into ERM: Partner with enterprise risk stakeholders to map security risks into the enterprise taxonomy, align rating scales, and keep the registers in sync.

- Mature the Program: Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program’s scope grows.

- Support FedRAMP 20x Risk Decisions: Help make sure unmet FedRAMP rules and KSI gaps carry a documented risk explanation and senior-official acceptance in the Security Decision Record.

- Scale Through AI and Automation: Build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation,and share them across the team.

**Qualifications:** Must haves:

- Security risk assessment: Experience running scenario-based analyses of technical risks using NIST SP 800-30, FAIR, or a comparable method.

- Risk program maturity and ERM integration: Experience building or maturing a security risk program,methodology, register, treatment and exception workflow, and key risk indicators.

- Risk reporting and executive communication: Experience preparing quarterly risk reporting and building security risk content for executive and board decks.

- Security and compliance knowledge: Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2.

- AI fluency and tooling: Power user who has built AI skills, agents, or automations that materially increase risk-program throughput.

Nice to have:

- Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators.

## Skills

### Required
- NIST SP 800-30
- FAIR
- NIST 800-53
- NIST CSF
- ISO 27001
- SOC 2
- AI fluency
- automation

### Nice to have
- FedRAMP 20x
- Security Decision Record reporting

---

Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/plaid/4c4af954-2c70-4a3c-acc2-97c58211f920?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)