Job description

We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products. Plaid powers the tools millions of people rely on to live a healthier financial life. We work with thousands of companies like Venmo, SoFi, several of the Fortune 500, and many of the largest banks to make it easy for people to connect their financial accounts to the apps and services they want to use. Plaid’s network covers 12,000 financial institutions across the US, Canada, UK and Europe. Founded in 2013, the company is headquartered in San Francisco with offices in New York, Seattle, Washington D.C., Raleigh, London, and Amsterdam. ABOUT THE TEAM: The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls. Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners.We partner closely across the company to ensure Plaid’s platform remains secure, resilient, and aligned with industry and regulatory expectations.Security risk management is how Plaid makes informed security trade-offs—we identify and analyze the risks that could materially affect the business, make sure the right owners decide what to do about them, and turn that picture into reporting leadership and the board can act on. ABOUT THE ROLE: - You will run security risk assessments end-to-end within Plaid’s security risk management program—intake, scenario-based analysis, treatment decisions, and monitoring across security, infrastructure, and product risk. - You will work with engineering SMEs and risk owners on risks ranging from over-privileged access and supply-chain gaps to product abuse and AI adoption, giving owners a clear, defensible basis for accepting or mitigating each one. - You will build quarterly security risk reporting and the security risk content in leadership and board materials. - You will help integrate security risk into enterprise risk management, so it is tracked and weighed alongside the rest of the business. - You will help mature the program as its scope grows, and operate as an AI power user who automates the work so it scales. RESPONSIBILITIES: - Run Security Risk Assessments: Triage intake, run scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision. Your analysis turns vague concerns into decisions leadership can stand behind. - Build Quarterly Risk Reporting: Gather updates on material risks, prepare the Security Risk Review, and build the security risk content for executive and board decks. Your reporting gives leadership a clear, current view of where security risk sits and what’s being done about it. - Integrate Security Risk into ERM: Partner with enterprise risk stakeholders to map security risks into the enterprise taxonomy, align rating scales, and keep the registers in sync. Your work puts security risk alongside business risk instead of in a silo. - Mature the Program: Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program’s scope grows. Your work moves the program from tracking risks to measuring and reducing them. - Support FedRAMP 20x Risk Decisions: Help make sure unmet FedRAMP rules and KSI gaps carry a documented risk explanation and senior-official acceptance in the Security Decision Record, consistent with the risk register. Your work keeps Plaid’s FedRAMP risk posture defensible to agencies and assessors. - Scale Through AI and Automation: Build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation—and share them across the team. Your approach lets the program cover more risk without adding headcount. QUALIFICATIONS: Must haves: - Security risk assessment: - Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method. - Technical depth to engage engineers on architecture and controls, and to tell a real exposure from a hypothetical one. - Risk program maturity and ERM integration: - Experience building or maturing a security risk program—methodology, register, treatment and exception workflow, and key risk indicators. - Experience integrating security risk into an enterprise risk management program. - Risk reporting and executive communication: - Experience preparing quarterly risk reporting and building security risk content for executive and board decks. - Ability to turn technical risk into a concise executive narrative without overstating or hand-waving. - Security and compliance knowledge: - Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each. - AI fluency and tooling: - Power user who has built AI skills, agents, or automations that materially increase risk-program throughput—and who shares what works with the team. Nice to have: - Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI). Our mission at Plaid is to unlock financial freedom for everyone. To support that mission, we seek to build a diverse team of driven individuals who care deeply about making the financial ecosystem more equitable. We recognize that strong qualifications can come from both prior work experiences and lived experiences. We encourage you to apply to a role even if your experience doesn't fully match the job description. We are always looking for team members that will bring something unique to Plaid! Plaid is proud to be an equal opportunity employer and values diversity at our company. We do not discriminate based on race, color, national origin, ethnicity, religion or religious belief, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender, gender identity, gender expression, transgender status, sexual stereotypes, age, military or veteran status, disability, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state, and local laws. Plaid is committed to providing reasonable accommodations for candidates with disabilities in our recruiting process. If you need any assistance with your application or interviews due to a disability, please let us know at accommodations@plaid.com. Please review our Candidate Privacy Notice here plaid.com. Additional compensation in the form(s) of equity and/or commission are dependent on the position offered. Plaid provides a comprehensive benefit plan, including medical, dental, vision, and 401(k). Pay is based on factors such as (but not limited to) scope and responsibilities of the position, candidate's work experience and skillset, and location. Pay and benefits are subject to change at any time, consistent with the terms of any applicable compensation or benefit plans.

Requirements

Must-haves

The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls.
You will run security risk assessments end-to-end within Plaid’s security risk management program—intake, scenario-based analysis, treatment decisions, and monitoring across security, infrastructure, and product risk.
You will build quarterly security risk reporting and the security risk content in leadership and board materials.
You will help integrate security risk into enterprise risk management, so it is tracked and weighed alongside the rest of the business.
You will help mature the program as its scope grows, and operate as an AI power user who automates the work so it scales.
Mature the Program: Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program’s scope grows. Your work moves the program from tracking risks to measuring and reducing them.
Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
Technical depth to engage engineers on architecture and controls, and to tell a real exposure from a hypothetical one.
Experience building or maturing a security risk program—methodology, register, treatment and exception workflow, and key risk indicators.
Experience integrating security risk into an enterprise risk management program.
Experience preparing quarterly risk reporting and building security risk content for executive and board decks.
Ability to turn technical risk into a concise executive narrative without overstating or hand-waving.
Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each.
Power user who has built AI skills, agents, or automations that materially increase risk-program throughput—and who shares what works with the team.

Nice-to-haves

Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI).

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

airest

Platform: ashby
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)