Security GRC Program Manager - Third Party

Who we are

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About the team

The Stripe Security team is dedicated to improving the security of Stripe and its users. Our users trust us with some of their most sensitive information, and we make security a first-class consideration in everything we do. Security concerns are ever-evolving, creating an extremely dynamic environment for the Security team.

The goal of the Security GRC team at Stripe is to provide information security advice and operational structure to the Security organization and its customers, both internal and external to Stripe. The team is responsible for various functional areas, including Security Governance, Risk, Compliance, Go-To-Market security support, Security Awareness, and Third Party Security Risk Assessment (TPSRA). 

The Security GRC Program Manager position will be part of Stripe’s CISO pillar and will have the ability to influence the continuous buildout of the Third Party Security Risk Assessment (TPSRA) program including developing policies, standards and processes to support the program.

You Will:

• Support the Third Party Security Risk Assessment (TPSRA) program operations, including creating awareness amongst the Stripe community,.

• Support the completion of the information security review process for all new third parties and annual reviews for all other relationships that receive and/or interact with Stripe data.

• Function as the Third Party Security Risk management subject matter expert supporting cross-functional teams looking to onboard third parties in processes that interact with Stripe’s data.

• Contribute to security policies and standards for assessing Third Party Security Risk.

• Identify Third Party Security Risk program gaps and drive the implementation of recommended mitigations.

• Partner with cross-functional stakeholders to identify, analyze and mitigate Third Party Security Risks associated with outsourced activities and products.

• Operate autonomously leading assessments, and working on large-scale efforts across multiple teams and functions, with stakeholders across different time zones.

• Contribute to formalizing and streamlining the Third Party Security Risk program processes to improve SLAs and provide better customer service.

• Report on the program’s health and success metrics to provide insights to management to help drive strategic direction.

What You'll Need:

• Strong background in cyber security operations, risks and controls identification and assessment

• Working technical knowledge of security, as well as industry trends

• Subject matter expert in cyber and information security practices, policies, standards and procedures (e.g. NIST CSF or equivalent)

• Experience implementing and operating programs for Security Compliance, IT Compliance, Information/Cyber security or Security Risk Management

• You have experience driving mid to large-scale projects and programs from start to finish within highly complex operating environments

• You have strong written and verbal communication skills, building strong relationships at all levels of the organization from executives to project teams

• Knowledge of how to use data to influence program strategy and tell compelling stories about organizational effectiveness and impact

Bonus Points:

• Report on program performance via dashboards, OKRs and perform basic data analysis (e.g. SQL, Redshift, Tableau)

• Experience working with JIRA, Whistic, Bitsight

• Experience working with engineers for the automation of security controls