Senior Security Analyst, Security Risk Management

The Security Governance, Risk, and Compliance (GRC) team is part of Plaid's security organization, focused on proactively managing information security risks and maintaining effective controls. Security risk management is how Plaid makes informed security trade-offs: identifying and analyzing risks that could materially affect the business, ensuring the right owners decide how to address them, and turning that picture into reporting leadership and the board can act on. The role involves running security risk assessments end-to-end, building quarterly security risk reporting, integrating security risk into enterprise risk management, helping mature the program, and operating as an AI power user who automates the work so it scales.

Responsibilities

Run security risk assessments end-to-end: triage intake, run scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision; Build quarterly security risk reporting: gather updates on material risks, prepare the Security Risk Review, and build security risk content for executive and board decks; Integrate security risk into ERM: map security risks into the enterprise taxonomy, align rating scales, and keep registers in sync; Mature the program: help evolve the risk framework, register, key risk indicators, and risk-owner self-service; Support FedRAMP 20x risk decisions: ensure unmet FedRAMP rules and KSI gaps carry a documented risk explanation and senior-official acceptance in the Security Decision Record; Scale through AI and automation: build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation

Requirements

Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method; Technical depth to engage engineers on architecture and controls, and to tell a real exposure from a hypothetical one; Experience building or maturing a security risk program (methodology, register, treatment and exception workflow, and key risk indicators); Experience integrating security risk into an enterprise risk management program; Experience preparing quarterly risk reporting and building security risk content for executive and board decks; Ability to turn technical risk into a concise executive narrative without overstating or hand-waving; Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each; AI fluency: power user who has built AI skills, agents, or automations that materially increase risk-program throughput and who shares what works with the team

Nice to have

Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI)

Benefits

Comprehensive benefit plan including medical, dental, vision, and 401(k); Additional compensation in the form of equity and/or commission, dependent on the position offered