Security GRC Specialist

Coupang•Mountain View, CA

About The Position

The Security GRC Specialist will advance Coupang’s cybersecurity risk management capabilities, focusing on continuous risk monitoring, data-driven risk assessment, and control governance. The role develops scalable methods to identify, quantify, and monitor cybersecurity risks using technical signals, control performance data, and real-time risk indicators. In partnership with AI GRC, Security Engineering, Control Assurance, and Security Architecture, the specialist helps establish a unified risk management and control governance framework across AI and cybersecurity, translating technical risks into actionable insights and measurable risk reduction.

Requirements

At least 6 years of relevant experience in cybersecurity, technology risk management, security engineering, or cybersecurity GRC.
Track record of developing or implementing risk management methodologies, continuous monitoring capabilities, or data-driven security risk programs.
Working knowledge of cybersecurity and AI governance frameworks, such as NIST CSF, NIST AI RMF, ISO 42001, and ISO 27001, and relevant statutory and regulatory requirements.
Direct experience collaborating with engineering teams to turn telemetry, control performance, or architectural data into risk insights.
Bachelor’s degree in a related field or equivalent professional experience.
Strong expertise in cybersecurity risk management, security governance, or technology risk in high-scale technology environments.
Hands-on experience with continuous risk monitoring, runtime risk assessment, security telemetry, risk analytics, or data-driven measurement of control effectiveness.
Ability to translate technical security signals, cloud vulnerabilities, and control deficiencies into meaningful business risk insights.
Deep understanding of cybersecurity control frameworks, risk quantification and assessment methodologies, and residual risk management.
Strong analytical, problem-solving, and cross-functional stakeholder management skills.
Self-starter mindset and ability to influence engineering teams and drive technical governance initiatives without direct authority.

Nice To Haves

Technical background in security engineering, cloud security, application security, security architecture, or security analytics.
Experience in application or product security, including building static and dynamic security testing tools.
Experience writing Java/Spring Boot applications in AWS and Kubernetes environments.
Experience with container scanning pipelines, open-source software vulnerability remediation pipelines, or Kubernetes security.
Experience leading or mentoring engineers to build a security or infrastructure service from scratch.
Experience identifying, testing, and remediating vulnerabilities, including those in the OWASP Top 10 and CWE/SANS Top 25, and writing exploits and verification.

Responsibilities

Develop and operationalize continuous, evidence-based cybersecurity risk management methodologies that provide ongoing visibility beyond periodic assessments.
Build and maintain data-driven risk models, indicators, and dashboards to identify emerging threats, systemic weaknesses, control gaps, and changes in residual risk.
Correlate technical risk signals, control effectiveness data, and business impact to prioritize risks and inform risk treatment decisions.
Establish and improve cybersecurity risk assessment methodologies, risk registers, risk scoring algorithms, and risk acceptance governance.
Work with Security and Engineering teams to identify runtime risk monitoring opportunities, automated risk signals, and ways to integrate security telemetry into risk workflows.
Collaborate with AI GRC on shared risk assessment methodologies, control governance principles, and reporting practices across AI and cybersecurity.
Partner with Control Assurance to incorporate assurance findings and control performance data into ongoing risk assessments and management reporting.
Identify systemic risk patterns and recurring control weaknesses and recommend actions to improve the organization’s risk posture.