Senior GRC Analyst

Runs day-to-day cyber risk work in WHOOP's GRC program, leading structured assessments of cyber, AI and technology risk in systems, cloud platforms, business processes and large initiatives. The analyst maintains the enterprise cyber risk register, turns technical findings into business risk scenarios, helps mature quantitative methods such as FAIR, prepares material for the Cyber Risk Committee and executive reporting, and works with Security Architecture, Engineering, Product Security, Legal and IT on new initiatives, AI use cases and third-party integrations. Exceptions management and SDLC reviews are included. WHOOP wants six or more years in cybersecurity or risk management, experience with structured risk assessments and risk registers, and knowledge of NIST CSF, ISO 27001 or PCI DSS and of AI governance frameworks. On-site in Boston.