Security GRC Specialist

Coupang•Mountain View, CA

7h•$164,000 - $282,000

About The Position

The Security GRC Specialist will help advance Coupang’s cybersecurity risk management capabilities, focusing on continuous risk monitoring, data-driven risk assessment, and control governance. The role develops scalable approaches to identify, quantify, and monitor cybersecurity risks using technical signals, control performance data, and real-time risk indicators. In partnership with AI GRC, Security Engineering, Control Assurance, and Security Architecture, the specialist will help establish a unified risk management and control governance framework across AI and cybersecurity, translating complex technical risks into actionable insights and measurable risk reduction.

Requirements

Strong expertise in cybersecurity risk management, security governance, or technology risk in high-scale technology environments.
Hands-on experience with continuous risk monitoring, runtime risk assessment, security telemetry, risk analytics, or data-driven control effectiveness measurement.
Ability to translate technical security signals, cloud vulnerabilities, and control deficiencies into meaningful business risk insights.
Deep understanding of cybersecurity control frameworks, risk quantification and assessment methodologies, and residual risk management.
Strong analytical, problem-solving, and cross-functional stakeholder management skills.
Self-starter mindset and ability to influence engineering teams and drive technical governance initiatives without direct authority.
At least 6 years of relevant experience in cybersecurity, technology risk management, security engineering, or cybersecurity GRC.
Demonstrated track record developing or implementing risk management methodologies, continuous monitoring capabilities, or data-driven security risk programs.
Working knowledge of cybersecurity and AI governance frameworks such as NIST CSF, NIST AI RMF, ISO 42001, and ISO 27001, as well as relevant statutory and regulatory requirements.
Direct experience collaborating with engineering teams to translate telemetry, control performance, or architectural data into risk insights.
Bachelor’s degree in a related field or equivalent professional experience.

Nice To Haves

Technical background in security engineering, cloud security, application security, security architecture, or security analytics.
Experience in application security or product security, including building static and dynamic security testing capabilities.
Experience writing Java/Spring Boot applications in AWS and Kubernetes environments.
Experience with security testing tools, container scanning pipelines, open-source software vulnerability remediation pipelines, and Kubernetes security.
Experience leading or mentoring engineers to build a security or infrastructure service from scratch.
Experience identifying, testing, and remediating vulnerabilities, including those found in the OWASP Top 10 and CWE/SANS Top 25, and writing exploits and verification.

Responsibilities

Develop and operationalize continuous cybersecurity risk management methodologies that provide ongoing, evidence-based risk visibility.
Build and maintain data-driven risk models, indicators, and dashboards to identify emerging threats, systemic weaknesses, control gaps, and changes in residual risk.
Connect technical risk signals, control effectiveness data, and business impact to prioritize risks and inform risk treatment decisions.
Establish and continuously improve cybersecurity risk assessment methodologies, risk registers, risk scoring algorithms, and risk acceptance governance.
Partner with Security and Engineering teams to identify opportunities for runtime risk monitoring, automated risk signals, and integration of security telemetry into risk management workflows.
Collaborate with AI GRC to develop common risk assessment methodologies, control governance principles, and reporting practices across AI and cybersecurity.
Partner with the Control Assurance team to incorporate assurance findings and control performance data into ongoing risk assessments and management reporting.
Identify systemic risk patterns and recurring control weaknesses and provide actionable recommendations to improve the organization’s overall risk posture.