Manager, Security Governance, Risk, and Compliance

Coupang • Mountain View, CA

1d

About The Position

The Security GRC Manager will lead the development of Coupang’s cybersecurity risk management and control governance capabilities, emphasizing continuous risk visibility, data-driven oversight, and measurable risk reduction. The role establishes scalable methods to identify, assess, prioritize, monitor, and escalate cybersecurity risks across a complex, high-scale technology environment, shifting from periodic assessments toward continuous, evidence-based risk management.

Working with AI GRC, Control Assurance, Security Engineering, Security Architecture, and Engineering teams, the manager will help create a unified enterprise risk management and control governance framework across AI and cybersecurity. This includes harmonizing industry standards and regulatory obligations, improving accountability for risk treatment, and enabling leadership to make informed decisions about the organization’s risk posture.

The manager will also lead and develop a high-performing Security GRC team, set strategic roadmaps and delivery standards, and influence business, product, and engineering stakeholders to embed risk accountability in software development and operations.

Requirements

• 6+ years of progressive experience in cybersecurity governance, risk management, security engineering, or a related field.
• Demonstrated experience building or maturing cybersecurity risk management capabilities in complex, high-scale technology environments.
• Proven experience leading teams, strategic initiatives, and cross-functional programs.
• Bachelor’s degree in a related field or equivalent professional experience.
• Working knowledge of cybersecurity and AI governance frameworks, including NIST CSF, NIST AI RMF, ISO 42001, and ISO 27001.
• Direct experience managing enterprise risk registers, overseeing remediation and treatment lifecycles, and reporting material risk exposure.
• Deep expertise in cybersecurity governance, risk management, and control frameworks, including the ability to translate technical weaknesses into business risk.
• Track record establishing risk assessment methodologies, risk registers, risk treatment workflows, and executive reporting.
• Demonstrated ability to move from periodic assessments toward continuous, data-driven risk management and evidence-based risk oversight.
• Strong understanding of control design, effectiveness testing, and the relationship between control performance and residual risk.
• Excellent communication and stakeholder management skills, including the ability to challenge risk decisions constructively and influence senior leaders.
• Experience leading cross-functional initiatives and mentoring governance, risk, or security professionals.
• Technical understanding of cloud infrastructure, application security, and modern security controls.

Nice To Haves

• Hands-on security engineering experience.
• Experience writing Java/Spring Boot applications in AWS and Kubernetes environments.
• Experience in application or product security, including building static and dynamic security testing tools, container-scanning pipelines, open-source software vulnerability remediation pipelines, or Kubernetes security.
• Experience leading or mentoring engineers to build a security or infrastructure service from scratch.
• Experience identifying, testing, and remediating vulnerabilities, including OWASP Top 10 and CWE/SANS Top 25 vulnerabilities; writing exploits and verification.

Responsibilities

• Drive scalable methodologies to identify, assess, prioritize, monitor, and escalate cybersecurity risks across high-scale technology environments.
• Partner with AI GRC to maintain a unified risk taxonomy and governance framework, harmonizing standards such as NIST CSF, NIST AI RMF, ISO 27001, and ISO 42001 with local and regional regulatory obligations.
• Maintain an actionable enterprise risk register that connects inherent risks, control gaps, treatment plans, and residual exposure through automated data feeds.
• Establish Key Risk Indicators and management reporting that translate technical findings, assurance results, and emerging threats into actionable business risk insights.
• Establish and mature the cybersecurity control governance framework, defining control objectives, ownership expectations, and effectiveness criteria.
• Partner with Control Assurance to incorporate testing trends and systemic control deficiencies into risk assessments without duplicating operational audit testing.
• Harmonize control frameworks across global regulatory requirements and internal standards to improve traceability and eliminate duplication.
• Collaborate with Control Assurance to prioritize automated control validation and real-time posture tracking.
• Lead, mentor, and scale a high-performing Security GRC team, setting strategic roadmaps, clear ownership, and measurable delivery standards.
• Work with accountable risk owners to establish remediation plans, track progress, and constructively challenge risk acceptance decisions.
• Influence engineering, product, and leadership stakeholders to embed risk accountability in software development and business operations.

Benefits

• Annual bonus of 0–20% of base salary.
• Medical, dental, vision, and life insurance, including AD&D insurance.
• Flexible Spending Accounts (FSA) and Health Savings Account (HSA).
• Long-term and short-term disability coverage.
• Employee Assistance Program (EAP).
• 401(k) plan with company match.
• 18–21 days of paid time off per year, based on tenure.
• 12 paid holidays.
• Paid parental leave.
• Pre-tax commuter benefits.
• Free electric car charging station.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager