Manager, Governance Risk & Compliance (GRC)
WHOOP · Boston, MA
About the role
Runs the day-to-day operation of WHOOP's governance, risk and compliance program, leading the team that carries out policy, risk, vendor and SSDLC assessment work. The manager reports progress to GRC leadership and partners with Legal, Security and Product to reduce enterprise risk and meet compliance goals.
The role triages incoming GRC requests and enterprise risk reviews, takes on the hardest assessments personally and assigns the rest, manages the team's workload and escalations, and reports weekly metrics and dashboards. It runs the vendor risk lifecycle with Legal, IT and Security, keeps the enterprise risk register covering technology, cybersecurity, privacy and third-party risk, and contributes directly to policy management, control testing, evidence collection, audits and continuous compliance. During security incidents the manager coordinates compliance obligations, regulatory documentation and remediation tracking.
WHOOP wants eight or more years in GRC or information security, two or more of them leading GRC, security or audit staff, extensive vendor risk assessment experience, a solid grasp of SSDLC risk reviews, and deep knowledge of ISO 27001, SOC 2, NIST CSF, HIPAA, GDPR and PCI DSS. CISSP, CRISC, CISA or ISO 27001 Lead Auditor certification is a plus. The role is on-site in Boston.