Security GRC Program Manager, Third Party

Who we are

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About the team

The Stripe Security team is dedicated to improving the security of Stripe and its users. Our users trust us with some of their most sensitive information, and we make security a first-class consideration in everything we do. Security concerns are ever-evolving, creating an extremely dynamic environment for the Security team.

The goal of the Security GRC team at Stripe is to provide information security advice and operational structure to the Security organization and its customers, both internal and external to Stripe. The team is responsible for various functional areas, including Security Governance, Risk, Compliance, Go-To-Market security support, Security Awareness, and Third Party Security Risk Assessment (TPSRA). 

The Security GRC Program Manager position will be part of Stripe’s CISO pillar and will have the ability to influence the continuous buildout of the Third Party Security Risk Assessment (TPSRA) program including developing policies, standards and processes to support the program.

You Will:

• Support the Third Party Security Risk Assessment (TPSRA) program operations, including creating awareness amongst the Stripe community,.
• Support the completion of the information security review process for all new third parties and annual reviews for all other relationships that receive and/or interact with Stripe data.
• Function as the Third Party Security Risk management subject matter expert supporting cross-functional teams looking to onboard third parties in processes that interact with Stripe’s data.
• Contribute to security policies and standards for assessing Third Party Security Risk.
• Identify Third Party Security Risk program gaps and drive the implementation of recommended mitigations.
• Partner with cross-functional stakeholders to identify, analyze and mitigate Third Party Security Risks associated with outsourced activities and products.
• Operate autonomously leading assessments, and working on large-scale efforts across multiple teams and functions, with stakeholders across different time zones.
• Contribute to formalizing and streamlining the Third Party Security Risk program processes to improve SLAs and provide better customer service.
• Report on the program’s health and success metrics to provide insights to management to help drive strategic direction.

What You'll Need:

• Minimum of 4 years of experience in a third party security risk role
• Strong background in third party security risk operations
• Strong understanding of enterprise security principles, third party risk management, and compliance/industry best practices
• Experience in the end-to-end management, implementation, and execution of third-party security risk assessment methodologies and processes
• Strong analytical skills to support assessment of risk and appropriate course of action
• You have strong written and verbal communication skills, building strong relationships at all levels of the organization from executives to project teams
• Knowledge of how to use data to influence program strategy and tell compelling stories about organizational effectiveness and impact

Bonus Points:

• Report on program performance via dashboards, OKRs and perform basic data analysis (e.g., Tableau)
• Experience working with JIRA, Zip, etc.
• Experience working with engineers for the automation of security controls