SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Plaid is seeking a Senior Security Analyst to lead security risk management within its Security Governance, Risk, and Compliance (GRC) team. The role focuses on proactively identifying, analyzing, and managing information security risks across Plaid's platform, which powers financial connectivity for millions of users and thousands of companies including Venmo, SoFi, and Fortune 500 firms.
You will own the end-to-end security risk assessment process: intake triage, scenario-based analysis using frameworks like NIST SP 800-30 or FAIR, risk scoring, and driving documented treatment decisions with engineering teams and risk owners. You'll engage deeply with technical stakeholders on cloud architecture, identity and access management, software supply chain, and product risks—translating complex technical exposures into clear, defensible narratives for leadership.
Key responsibilities include building quarterly security risk reporting and executive/board materials that give leadership a current, actionable view of the security risk landscape. You'll integrate security risk into enterprise risk management (ERM) so it's tracked alongside broader business risks rather than in isolation. As the program matures, you'll help evolve the risk framework, register, key risk indicators, and self-service capabilities for risk owners.
You'll support Plaid's FedRAMP compliance by ensuring unmet rules and Key Security Indicator gaps carry documented risk explanations and senior-official acceptance in the Security Decision Record. A key part of the role is scaling the program through AI and automation—building AI skills, agents, and automations for intake triage, first-draft analyses, register hygiene, and report generation, then sharing these tools across the team to increase throughput without adding headcount.
REQUIREMENTS:
Must Have:
- Security Risk Assessment: Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or comparable methodology. Technical depth to engage engineers on architecture and controls, and to distinguish real exposures from hypothetical ones.
- Risk Program Maturity and ERM Integration: Experience building or maturing a security risk program (methodology, register, treatment and exception workflow, key risk indicators). Experience integrating security risk into an enterprise risk management program.
- Risk Reporting and Executive Communication: Experience preparing quarterly risk reporting and building security risk content for executive and board decks. Ability to translate technical risk into concise executive narrative without overstating or hand-waving.
- Security and Compliance Knowledge: Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each.
- AI Fluency and Tooling: Power user who has built AI skills, agents, or automations that materially increase risk-program throughput and shares what works with the team.
Nice to Have:
- Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI).
