Senior Technical Risk & Compliance Analyst

LinkedIn•Mountain View, CA

20h•$143,000 - $218,000•Hybrid

About The Position

At LinkedIn, our approach to flexible work is centered on trust and optimized for culture, connection, clarity, and the evolving needs of our business. The work location of this role is hybrid, meaning it will be performed both from home and from a LinkedIn office on select days, as determined by the business needs of the team. LinkedIn is seeking a Senior Technical Risk & Compliance Engineer to support the end-to-end GRACE lifecycle across Security. Governance, Risk, Automation, Compliance & Engineering (GRACE) helps LinkedIn build and maintain a secure, scalable, and sustainable compliance environment. We partner across Security, Engineering, Legal, Privacy, Audit, and other teams to translate risk and compliance requirements into controls that can be implemented, monitored, and continuously improved. In this role, you will independently own defined Security risk and compliance areas, taking them from initial onboarding and risk assessment through control design, implementation partnership, assurance, continuous controls monitoring, and improvement. You will work closely with Security and Engineering teams to translate security, regulatory, policy, and assurance requirements into actionable control requirements; evaluate how those controls are implemented across systems; identify and drive remediation of gaps; and establish monitoring that provides ongoing visibility into control health. This role requires a combination of technical depth and risk and compliance expertise. The ideal candidate can understand modern security systems and technical architectures, analyze data and technical artifacts, and translate risk and compliance requirements into practical solutions that scale. Our goal is to move compliance away from fragmented, point-in-time activities toward a lifecycle where requirements, risks, controls, evidence, and monitoring are connected, enabling compliance to scale with LinkedIn’s technology and business.

Requirements

BA/BS degree in Computer Science, Engineering, Information Systems, or a related technical discipline, or equivalent practical experience.
5+ years of experience in technical risk, security compliance, technology compliance, security engineering, technical audit/assurance, or a related field.
Experience translating security, regulatory, policy, or assurance requirements into technical or operational controls.
Experience assessing technical control design and implementation and identifying control or compliance gaps.
Experience analyzing technical artifacts such as system designs, configurations, logs, data, scripts, queries, or code to understand control implementation.
Experience partnering with Engineering or Security teams to address technical risk and compliance requirements.
Ability to independently manage an assigned risk or compliance area, prioritize competing requirements, and clearly communicate technical risks and remediation needs.

Nice To Haves

Experience across Security domains such as IAM, Application Security, Cloud and Infrastructure Security, Vulnerability Management, Data Protection, Security Operations, Resilience, or Software Supply Chain Security.
Experience with security and assurance frameworks such as ISO 27001, SOC 2, PCI DSS, NIST, or comparable regulatory and industry frameworks.
Experience working with large-scale distributed systems, cloud infrastructure, or modern software development environments.
Experience using data, telemetry, dashboards, and automated workflows to evaluate control effectiveness and identify risk.
Experience designing or supporting continuous controls monitoring, automated evidence collection, or compliance automation.
Experience with GRC systems, risk registers, control inventories, evidence pipelines, and compliance systems of record.
Experience supporting security assessments, certifications, audits, or regulatory reviews.
Ability to identify systemic patterns across control gaps and findings and translate them into scalable technical or process improvements.
Relevant professional certifications such as CISSP, CISA, or equivalent.

Responsibilities

Drive the End-to-End Technical Governance, Risk & Compliance Lifecycle for Security
Independently own defined Security areas through the GRACE lifecycle, from initial risk and compliance onboarding through continuous monitoring and improvement.
Evaluate applicable regulatory, security, policy, customer, and assurance requirements and map them to risks, control objectives, controls, systems, and accountable owners.
Assess current systems, processes, and existing controls to identify coverage and compliance gaps.
Translate identified risks and requirements into clear, measurable control objectives and technical control requirements.
Maintain accurate requirement-to-risk-to-control mappings and supporting documentation in compliance systems of record.
Design and Codify Controls
Partner with Security and Engineering teams to translate control requirements into practical, testable controls within systems and engineering workflows.
Evaluate system architecture, data flows, configurations, access models, logs, scripts, queries, code, and other technical artifacts to understand how controls address identified risks.
Review existing control design and implementation and recommend improvements where controls do not sufficiently address requirements or risks.
Identify opportunities to embed and automate controls within engineering workflows, platforms, infrastructure, and security systems.
Ensure controls have clear ownership, expected evidence, testable criteria, and monitoring requirements.
Establish Continuous Controls Monitoring
Translate control design and effectiveness criteria into measurable monitoring requirements.
Use system-generated data, dashboards, telemetry, logs, configurations, and other technical signals to monitor control execution, exceptions, and control health.
Partner with Engineering and Security teams to establish automated monitoring and evidence generation where feasible.
Identify control failures, anomalies, exceptions, and emerging compliance gaps and work with control owners to prioritize remediation based on risk.
Help transition assigned Security areas from point-in-time evidence collection and assessments toward continuous controls monitoring and audit-ready-by-default compliance.
Identify opportunities to reduce manual compliance activities through reusable control monitoring, evidence pipelines, and automation.
Assurance, Remediation & Improvement
Perform readiness assessments to evaluate whether controls are appropriately designed and operating as intended before relying on them for continuous monitoring and assurance.
Support internal and external assessments, certifications, audits, and regulatory requirements with reliable, reusable technical evidence and control documentation.
Coordinate remediation of identified control gaps and findings, including root-cause analysis, risk-based prioritization, and issue tracking through closure.
Analyze monitoring results, exceptions, findings, and recurring issues to identify systemic patterns and recommend durable improvements.
Feed insights from monitoring and assurance back into risk assessments, policies, control design, and monitoring requirements to continuously improve the Security compliance posture.
Security Compliance Coverage
The role may support risk and compliance activities across Security areas including: Identity and Access Management and Privileged Access Management, Application Security and Secure Software Development, Cloud and Infrastructure Security, Vulnerability Management, Data Protection, Encryption, Key and Secrets Management, Security Logging, Monitoring, Detection, and Incident Response, Software Supply Chain and Third-Party Security, Security Resilience and Business Continuity, AI Security and emerging technology risk, Security governance, policies, standards, and exceptions.
The successful candidate is not expected to be an expert in every Security domain, but should bring strong technical risk and compliance depth in one or more areas and be able to apply that foundation across adjacent Security domains.