Manager, Security Governance, Risk, and Compliance

The Security GRC Manager will lead the evolution of Coupang's cybersecurity risk management and control governance capabilities, with a focus on continuous risk visibility, data-driven risk oversight, and measurable risk reduction. This leader will establish scalable methodologies to identify, assess, prioritize, and monitor cybersecurity risks across Coupang's complex technology environment, moving beyond periodic assessments toward continuous, evidence-based risk management. Working closely with AI GRC, Control Assurance, Security Engineering, Security Architecture, and broader Engineering teams, the Security GRC Manager will help develop a unified enterprise risk management and control governance framework across AI and cybersecurity.

Responsibilities

Drive scalable methodologies to identify, assess, prioritize, monitor, and escalate cybersecurity risks across high-scale technology environments; Partner closely with AI GRC to maintain a unified risk taxonomy and governance framework, harmonizing global industry standards (NIST CSF, NIST AI RMF, ISO 27001, ISO 42001) with local and regional regulatory obligations; Maintain an actionable enterprise risk register connecting inherent risks, control gaps, treatment plans, and residual exposure through automated data feeds; Establish Key Risk Indicators and management reporting to translate technical findings, assurance results, and emerging threats into actionable business risk insights; Establish and mature the cybersecurity control governance framework, defining control objectives, ownership expectations, and effectiveness criteria; Partner with Control Assurance to ingest testing trends and systemic control deficiencies into risk assessments without duplicating operational audit testing; Drive control framework harmonization across global regulatory requirements and internal standards to improve traceability and eliminate duplication; Collaborate with Control Assurance to define priorities for automated control validation and real-time posture tracking; Lead, mentor, and scale a high-performing Security GRC team, setting strategic roadmaps, clear ownership, and measurable delivery standards; Partner with accountable risk owners across the business to establish remediation plans, track progress, and constructively challenge risk acceptance decisions; Influence cross-functional engineering, product, and leadership stakeholders to embed risk accountability directly into software development and business operations

Requirements

Deep expertise in cybersecurity governance, risk management, and control frameworks, with the ability to translate technical weaknesses into business risk; Proven track record establishing risk assessment methodologies, risk registers, risk treatment workflows, and executive reporting; Demonstrated ability to evolve periodic assessments toward continuous, data-driven risk management and evidence-based risk oversight; Strong understanding of control design, effectiveness testing, and the relationship between control performance and residual risk; Excellent communication and stakeholder management skills, including the ability to constructively challenge risk decisions and influence senior leaders; Experience leading cross-functional initiatives and mentoring governance, risk, or security professionals; Technical understanding of cloud infrastructure, application security, and modern security controls; 6+ years of progressive experience in cybersecurity governance, risk management, security engineering, or a related field; Demonstrated experience building or maturing cybersecurity risk management capabilities in complex, high-scale technology environments; Proven experience leading teams, strategic initiatives, and cross-functional programs; Bachelor's degree in a related field or equivalent professional experience; Working knowledge of cybersecurity and AI governance frameworks, including NIST CSF, NIST AI RMF, ISO 42001, and ISO 27001; Direct experience managing enterprise risk registers, overseeing remediation/treatment lifecycles, and reporting material risk exposure

Nice to have

Experience in writing java/spring boot applications in AWS and Kubernetes environment; Experience in application security/product security in building static and dynamic security testing tools, container scanning pipelines, open-source software vulnerabilities remediation pipelines, Kubernetes security; Experience in leading/mentoring other engineers to build a security or infrastructure service from scratch; Experience identifying, testing, and remediating against vulnerabilities including those found in the OWASP Top 10 and CWE/SANS Top 25, writing exploits and verification; Hands-on security engineering experience

Benefits

Annual bonus is 0-20% of the base salary; Medical/Dental/Vision/Life, AD&D insurance; Flexible Spending Accounts (FSA) and Health Savings Account (HSA); Long-term/Short-term Disability; Employee Assistance Program (EAP); 401K Plan with Company Match; 18-21 days of Paid Time Off (PTO) a year based on tenure; 12 Paid Holidays; Paid Parental leave; Pre-tax commuter benefits; Free electric car charging station