Security Risk Management Lead
At Plaid, we believe that the future of finance is open, accessible, and designed around the user. We're dedicated to empowering this transformation by building the essential tools and experiences that thousands of developers use to create innovative products. Plaid powers the apps millions of people rely on daily for a healthier financial life, partnering with industry leaders like Venmo, SoFi, Fortune 500 companies, and major banks. Our network seamlessly connects to 12,000 financial institutions across the US, Canada, UK, and Europe. Founded in 2013, Plaid is headquartered in San Francisco with a growing global presence.
About the Team: Guardians of Trust
The Security Governance, Risk, and Compliance (GRC) team is a cornerstone of Plaid's security organization. Our mission is to proactively manage information security risks, build robust assurance programs, and foster unwavering trust with our customers, consumers, and data partners. We’re not just a compliance checkbox; we’re strategic partners across the company, ensuring Plaid’s platform remains secure, resilient, and aligned with the highest industry and regulatory expectations. We empower informed security trade-offs, identifying and analyzing critical risks, driving treatment decisions, and delivering actionable insights directly to leadership and the board.
The Opportunity: Lead Security Risk Management at Plaid
As a Security Risk Management Lead, you will be instrumental in safeguarding Plaid’s innovative financial ecosystem. You'll operate at the intersection of cutting-edge technology and strategic security, transforming complex technical risks into clear, actionable decisions for our leadership. This is a chance to define and mature a critical function, leveraging your expertise to scale our security posture in a dynamic, high-growth environment, and pioneering the use of AI to drive efficiency.
What You'll Do: Drive End-to-End Security Risk Assessments: Take ownership of the entire risk assessment lifecycle, from intake and scenario-based analysis to treatment decisions and continuous monitoring across security, infrastructure, and product risks. Your expertise will provide a clear, defensible basis for accepting or mitigating risks. What You'll Bring: Core Technical Expertise: Proven experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application, and product) utilizing established methodologies like NIST SP 800-30, FAIR, or comparable frameworks. Strategic Program Leadership & Acumen: Experience building or maturing a comprehensive security risk program, including methodology development, register management, treatment/exception workflows, and defining key risk indicators. Compliance & Framework Knowledge: Working knowledge of industry-standard frameworks such as NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and a clear understanding of how risk management principles underpin each. Innovative Edge: A power user of AI, with tangible experience in building AI skills, agents, or automations that have materially increased risk-program throughput and a willingness to share these innovations with the team. Bonus Points: Hands-on FedRAMP 20x experience, including Security Decision Record (SDR) reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI). Our Commitment to You Plaid is proud to be an equal opportunity employer and values diversity at our company. We do not discriminate based on race, color, national origin, ethnicity, religion or religious belief, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender, gender identity, gender expression, transgender status, sexual stereotypes, age, military or veteran status, disability, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state, and local laws. Plaid is committed to providing reasonable accommodations for candidates with disabilities in our recruiting process. If you need any assistance with your application or interviews due to a disability, please let us know at [email protected]. Please review our Candidate Privacy Notice here. Additional compensation in the form(s) of equity and/or commission are dependent on the position offered. Plaid provides a comprehensive benefit plan, including medical, dental, vision, and 401(k). Pay is based on factors such as (but not limited to) scope and responsibilities of the position, candidate's work experience and skillset, and location. Pay and benefits are subject to change at any time, consistent with the terms of any applicable compensation or benefit plans.
Collaborate on Diverse Risk Scenarios: Partner with engineering SMEs and risk owners on a wide array of challenges, including over-privileged access, supply-chain vulnerabilities, product abuse, and the security implications of AI adoption, guiding them to optimal solutions.
Develop Executive & Board-Level Risk Reporting: Build comprehensive quarterly security risk reporting and craft the security risk content for executive and board materials, offering leadership a clear, current view of our risk landscape and mitigation strategies.
Integrate Security into Enterprise Risk Management: Help bridge the gap between security and broader business strategy by integrating security risks into the enterprise risk management framework, ensuring they are tracked and weighed alongside other business risks.
Mature & Evolve the Risk Program: Contribute to the continuous evolution of our security risk framework, register, key risk indicators, and risk-owner self-service capabilities as our program's scope expands.
Ensure FedRAMP Risk Defensibility: Support the documentation of FedRAMP 20x risk decisions, ensuring that unmet rules and KSI gaps carry documented risk explanations and senior-official acceptance, maintaining a defensible posture for agencies and assessors.
Pioneer AI-Driven Automation: Act as an AI power user, building skills, agents, or automations for intake triage, first-draft risk analyses, register hygiene, and report generation, sharing best practices to significantly increase program throughput without adding headcount.
Demonstrated technical depth to effectively engage engineers on architectural designs and control implementations, accurately distinguishing between theoretical and actual exposures.
Hands-on experience integrating security risk into a broader enterprise risk management (ERM) program.
Exceptional ability to prepare quarterly risk reporting and craft compelling security risk content for executive and board presentations, translating complex technical risks into concise, impactful narratives without overstating or oversimplifying.
At Plaid, our mission is to unlock financial freedom for everyone. To support that mission, we are committed to building a diverse team of driven individuals who care deeply about making the financial ecosystem more equitable. We recognize that strong qualifications can come from both prior work experiences and lived experiences. We encourage you to apply to a role even if your experience doesn't fully match the job description. We are always looking for team members that will bring something unique to Plaid!