Senior Security Risk Analyst, GRC

DoorDash USA

11h•$132,600 - $195,000

About The Position

DoorDash’s Global Governance, Risk and Compliance (GRC) team helps the business scale securely through practical risk-based decisions, reliable controls, and clear accountability. Its third-party risk program protects the systems and data behind DoorDash, Wolt, and Deliveroo. The Senior Security Risk Analyst will help run and shape the security risk management program and treatment plans. The role enables risk and control owners and security teams to keep risk at an acceptable level as the business grows. It involves cross-functional risk assessments and reporting, supporting policy exceptions, and automating the tools and processes used to maintain an accurate and trustworthy risk register. The analyst will also investigate controls in specific business areas, identify where issues have occurred, and help address problems proactively. The position reports to the Senior Security Risk Manager on the GRC team in the Security organization. The role leads the global risk management process, examines how controls operate in practice, incorporates threat intelligence, manages policy exceptions, owns risk reporting for key areas, and contributes to team strategy and tooling. The expected fill date is December 16, 2026.

Requirements

At least 4 years of experience in security risk, GRC, or a related field.
Bachelor’s degree in a technology-related field, or an additional 4 years of work experience in a technology-related field.
Fluency in risk management frameworks, including the NIST Cybersecurity Framework (CSF).
Ability to translate technical risk into language that technical and non-technical audiences can act on.
Strong written and verbal communication skills, including the ability to turn complex control requirements into clear, actionable guidance.
Comfort owning risk metrics and reporting and demonstrating program effectiveness.
Experience automating workflows, or interest in agentic AI workflows.

Nice To Haves

Experience implementing or using GRC tooling.
Experience with AI-related risk.
Experience in controls assurance and effectiveness testing.

Responsibilities

Lead the global risk management process, including assessing risk, negotiating treatment plans with owners, and translating regulatory and framework changes into working controls.
Examine how controls operate day to day and use threat intelligence to anticipate new threat actors and attack vectors.
Manage policy exceptions by developing compensating controls or making a case for risk acceptance.
Own risk reporting for key areas such as security or engineering, serve as the primary risk contact for at least one area, and help reduce risk measurably.
Collaborate and report across GRC, security teams, and the broader business.
Help shape team strategy and tooling, including building automations.
Run risk assessments and support risk reporting and maintenance of an accurate, trustworthy risk register.
Deep-dive into business-area controls, surface issues, and help address them proactively.

Benefits

401(k) plan with employer matching.
16 weeks of paid parental leave.
Wellness benefits.
Commuter benefits match.
Paid time off and paid sick leave.
Flexible paid time off/vacation for salaried roles, plus 80 hours of paid sick time per year.
Vacation accrual for hourly roles.
Medical, dental, and vision benefits.
11 paid holidays.
Disability insurance and basic life insurance.
Family-forming assistance.
Mental health program.
Equity grant opportunities.
Wellness expense reimbursement.
Premium healthcare.