# Senior GRC Analyst

**Company:** [WHOOP](https://hotfix.jobs/companies/whoop)
**Location:** Boston, MA
**Role:** Security Engineering
**Experience:** 6+ years
**Skills:** Cybersecurity, Risk Assessment, risk register, nist csf, ISO 27001, pci dss, GDPR, HIPAA, fair, nist ai rmf, iso/iec 42001, crisc, cissp, cisa, cgrc
**Posted:** 2026-07-17

> Senior GRC Analyst leading day-to-day cyber, AI, and technology risk assessments, risk register maintenance, and quantitative analysis (FAIR) at WHOOP. Requires 6+ years in cybersecurity/risk management, framework expertise (NIST, ISO), and ability to translate technical risks for executives.

## Job Description

## Responsibilities
- Lead cyber, AI, and technology risk assessments across systems, cloud environments, business processes, and major initiatives, evaluating threats, vulnerabilities, control effectiveness, and residual risk.
- Maintain and operate the enterprise cyber risk register, including drafting risk statements, tracking mitigation plans, and supporting governance and reporting processes.
- Translate technical findings, architectural concerns, and control gaps into clear business risk scenarios that support prioritization and decision-making.
- Support and help mature quantitative cyber risk analysis approaches such as FAIR to improve how risk is measured and communicated.
- Prepare materials and analysis to support the Cyber Risk Committee and executive risk reporting.
- Partner with Security Architecture to assess risk in system designs, cloud architecture, identity models, data flows, and platform changes.
- Collaborate with Security Engineering, Product Security, Legal, IT, and business teams to evaluate new initiatives, technology changes, artificial intelligence use cases, and third-party integrations through a risk lens.
- Conduct risk assessments for emerging technologies including artificial intelligence and machine learning systems, evaluating data usage, model behavior, external dependencies, and security implications.
- Develop dashboards and reporting that provide leadership with visibility into key cybersecurity risks and trends.
- Contribute to the continued development of cyber risk management processes.

## Qualifications
- 6+ years of experience in cybersecurity or enterprise risk management, information security, or a related field.
- Demonstrated experience conducting structured cybersecurity or IT risk assessments.
- Experience maintaining risk registers and tracking risk mitigation or treatment activities.
- Deep understanding of security frameworks such as NIST CSF, ISO 27001, or PCI DSS, and familiarity with regulatory environments such as GDPR, HIPAA or other privacy and data protection requirements.
- Ability to translate technical findings into clear business risk for non-technical stakeholders.
- Strong written and verbal communication skills with experience presenting findings to cross-functional teams.
- Experience assessing risks related to artificial intelligence, machine learning systems, or emerging technologies, including familiarity with emerging AI governance frameworks such as NIST AI RMF, ISO/IEC 42001, or similar standards.
- Professional certifications such as CRISC, CISSP, CISA, or CGRC are a plus.

## Similar roles

- [Senior Software Security Engineer](https://hotfix.jobs/jobs/bd83bbb8-d7c1-42bd-811f-3cdd8a53d7ca) - GitLab - Remote - $139k – $196k/yr
- [Senior Detection Engineer](https://hotfix.jobs/jobs/6e9f5f26-7b5d-45a6-ad57-701c49e31283) - Fluidstack - New York, NY - $176k – $218k/yr
- [Senior Security Engineer, Bug Bounty](https://hotfix.jobs/jobs/5532c56d-7528-4966-9a33-ffec20c4a012) - Mozilla - Remote - $116k – $183k/yr
- [Senior Security Engineer, Bug Bounty](https://hotfix.jobs/jobs/7b8b62b3-cb93-4615-9276-eea6ffc68ccf) - Mozilla - Remote
- [Regional Site Security Lead, Deployment & Ops](https://hotfix.jobs/jobs/230fbb8b-e9a3-4d1c-a92a-ddc985723452) - Fluidstack - Austin, TX - $225k – $325k/yr

**Apply:** https://hotfix.jobs/jobs/1633b6a7-13f6-4a44-9d94-86586810d525
**Canonical:** https://hotfix.jobs/jobs/1633b6a7-13f6-4a44-9d94-86586810d525