Senior Manager: Governance, Risk, & Compliance (GRC)

Leads WHOOP's GRC team and the company's information security governance program, setting its roadmap with stakeholders across the business and assessing the risks the company faces as it grows. The senior manager works closely with Product, Engineering, Data Analytics and Legal to improve WHOOP's security posture.

The role mixes strategy with hands-on delivery. It owns the design and evolution of the GRC program and of the control frameworks, policies, standards and security awareness efforts behind it, contributing directly while directing the team. The senior manager runs the enterprise risk register, sets risk priorities and reports to executives, turns lessons from incident response into improvements to the risk and compliance program, and keeps refining GRC tooling, processes and metrics. Managing, mentoring and developing GRC analysts, and knowing when to delegate as the program grows, are central to the job.

WHOOP wants ten or more years in GRC or information security, five or more of them managing GRC or security professionals, a record of scaling GRC programs for technology teams, and deep knowledge of ISO 27001, SOC 2, GDPR, PCI and NIST CSF. A CISA, CISSP, CRISC, CIPP/E or ISO Lead Auditor credential helps, as does experience setting DevSecOps, AI governance or SSDLC guardrails. The role is on-site in Boston.