Stripe
Security GRC Program Manager, Third Party Risk
US - Hybrid +1 · Manager · Full-time · Posted Oct 6, 2026
- Location
- US - Hybrid
US - Experience
- 4+ years of relevant experience in third-party security risk, security assessments, information security, or a related risk-management function.
About the job
Manages third-party security risk assessments and related remediation, risk decisions, and program improvements for Stripe’s third-party relationships.
What you'll do
- Manage end-to-end assessments for new engagements, renewals, reassessments, and material scope changes; review evidence and evaluate controls.
- Identify security gaps, define proportionate remediation, document findings, and escalate complex or high-risk issues.
- Track program health and improve assessment processes, documentation, tooling, policies, and guidance.
What they ask for
- Experience conducting end-to-end third-party security assessments, including reviewing documentation, identifying control gaps, assessing risk, and defining remediation.
- Working knowledge of security and assurance frameworks such as SOC 2, ISO 27001, PCI DSS, NIST, and CSA.
- Ability to manage multiple assessments and stakeholder relationships while meeting timelines.
- Strong analytical judgment and clear written and verbal communication skills, including explaining technical findings to non-security stakeholders.
Nice to have
- Experience with third-party risk or procurement workflow platforms such as Aravo or Zip.
- Experience with Enhanced Due Diligence, security risk acceptance, third-party incident response, or scaling a third-party risk assessment program.
Tools
SOC 2, ISO 27001, PCI DSS, NIST, CSA, Zip, Aravo
Model-written summary · the original posting is authoritative