Whoop
Senior GRC Analyst
$130K–$170K
Boston, MA · On-site · Senior · Full-time · Posted Jul 17, 2026
- Experience
- 6+ years in cybersecurity or enterprise risk management, information security, or a related field.
About the job
Leads day-to-day cybersecurity, technology, and AI risk assessment and GRC operations, translating findings into business risks and supporting governance and reporting.
What you'll do
- Lead cyber, technology, and AI risk assessments; evaluate threats, vulnerabilities, controls, and residual risk.
- Maintain the enterprise cyber risk register, track mitigation plans, and support governance and executive reporting.
- Partner across Security, Legal, Product, and other teams to assess technology initiatives and improve cyber risk processes.
What they ask for
- Demonstrated experience conducting structured cybersecurity or IT risk assessments.
- Experience maintaining risk registers and tracking risk mitigation or treatment activities.
- Knowledge of security frameworks such as NIST CSF, ISO 27001, or PCI DSS, and familiarity with privacy requirements such as GDPR or HIPAA.
- Experience assessing AI, machine learning, or emerging-technology risks, including familiarity with AI governance frameworks.
Nice to have
- Professional certifications such as CRISC, CISSP, CISA, or CGRC.
- Experience supporting quantitative cyber risk analysis approaches such as FAIR.
Pay
$130,000 - $170,000 USD base salary
Tools
NIST CSF, ISO 27001, PCI DSS, GDPR, HIPAA, FAIR, NIST AI RMF, ISO/IEC 42001
AI focus
Conduct AI and machine-learning risk assessments, evaluating data usage, model behavior, external dependencies, security implications, and governance.
Model-written summary · the original posting is authoritative