Manager, Security Governance, Risk, and Compliance
About The Position
The Security GRC Manager will lead the development of Coupang’s cybersecurity risk management and control governance capabilities, emphasizing continuous risk visibility, data-driven oversight, and measurable risk reduction. The role establishes scalable methods to identify, assess, prioritize, monitor, and escalate cybersecurity risks across a complex, high-scale technology environment, moving beyond periodic assessments toward continuous, evidence-based management. Working with AI GRC, Control Assurance, Security Engineering, Security Architecture, and Engineering teams, the manager will help build a unified enterprise risk management and control governance framework spanning AI and cybersecurity. The role promotes consistent risk methods, effective control governance, and clear accountability for risk treatment, helping leadership understand and act on the organization’s evolving risk posture. The position also leads and develops the Security GRC team, partners with business risk owners on remediation and risk acceptance, and influences engineering, product, and leadership stakeholders to embed risk accountability into software development and business operations.
Requirements
- 6 or more years of progressive experience in cybersecurity governance, risk management, security engineering, or a related field.
- Bachelor’s degree in a related field or equivalent professional experience.
- Deep expertise in cybersecurity governance, risk management, and control frameworks, with the ability to translate technical weaknesses into business risk.
- Experience establishing risk assessment methodologies, risk registers, risk treatment workflows, and executive reporting.
- Demonstrated ability to evolve periodic assessments toward continuous, data-driven risk management and evidence-based risk oversight.
- Strong understanding of control design, effectiveness testing, and the relationship between control performance and residual risk.
- Excellent communication and stakeholder management skills, including the ability to challenge risk decisions constructively and influence senior leaders.
- Experience leading cross-functional initiatives and mentoring governance, risk, or security professionals.
- Technical understanding of cloud infrastructure, application security, and modern security controls.
- Experience building or maturing cybersecurity risk management capabilities in complex, high-scale technology environments.
- Proven experience leading teams, strategic initiatives, and cross-functional programs.
- Working knowledge of cybersecurity and AI governance frameworks, including NIST CSF, NIST AI RMF, ISO 42001, and ISO 27001.
- Direct experience managing enterprise risk registers, overseeing remediation and treatment lifecycles, and reporting material risk exposure.
Nice To Haves
- Hands-on security engineering experience.
- Experience writing Java/Spring Boot applications in AWS and Kubernetes environments.
- Experience in application or product security, including building static and dynamic security testing tools, container-scanning pipelines, open-source software vulnerability remediation pipelines, and Kubernetes security.
- Experience leading or mentoring engineers to build a security or infrastructure service from scratch.
- Experience identifying, testing, and remediating vulnerabilities, including those in the OWASP Top 10 and CWE/SANS Top 25, and writing exploits and verification.
Responsibilities
- Develop and drive scalable methods to identify, assess, prioritize, monitor, and escalate cybersecurity risks across high-scale technology environments.
- Partner with AI GRC to maintain a unified risk taxonomy and governance framework, aligning standards such as NIST CSF, NIST AI RMF, ISO 27001, and ISO 42001 with local and regional regulatory requirements.
- Maintain an actionable enterprise risk register that connects inherent risks, control gaps, treatment plans, and residual exposure through automated data feeds.
- Establish Key Risk Indicators and management reporting that translate technical findings, assurance results, and emerging threats into actionable business risk insights.
- Establish and mature the cybersecurity control governance framework, including control objectives, ownership expectations, and effectiveness criteria.
- Partner with Control Assurance to incorporate testing trends and systemic control deficiencies into risk assessments without duplicating operational audit testing.
- Harmonize control frameworks across global regulatory requirements and internal standards to improve traceability and reduce duplication.
- Collaborate with Control Assurance to prioritize automated control validation and real-time posture tracking.
- Lead, mentor, and scale a high-performing Security GRC team, setting strategic roadmaps, clear ownership, and measurable delivery standards.
- Work with accountable risk owners to establish remediation plans, track progress, and constructively challenge risk acceptance decisions.
- Influence engineering, product, and leadership stakeholders to embed risk accountability into software development and business operations.
Benefits
- Annual bonus of 0–20% of base salary.
- Medical, dental, vision, and life insurance, plus AD&D insurance.
- Flexible Spending Accounts (FSA) and Health Savings Account (HSA).
- Long-term and short-term disability coverage.
- Employee Assistance Program (EAP).
- 401(k) plan with company match.
- 18–21 days of paid time off per year, based on tenure.
- 12 paid holidays.
- Paid parental leave.
- Pre-tax commuter benefits.
- Free electric car charging station.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Manager
