Senior Security Analyst, Security Risk Management

Plaid is hiring a Senior Security Analyst to strengthen security risk management within the Security Governance, Risk, and Compliance (GRC) program. This role runs end-to-end security risk assessments and turns findings into clear, defensible reporting that leadership and the board can use to make informed security trade-offs.

As part of the GRC team, you will help reduce the likelihood and impact of security risks through a robust assurance approach, partnering across the company to keep Plaid’s platform secure, resilient, and aligned with industry and regulatory expectations.

What you’ll do

• Run security risk assessments end-to-end within Plaid’s security risk management program, including intake, scenario-based analysis, treatment decisions, and monitoring across security, infrastructure, and product risk.
• Collaborate with engineering SMEs and risk owners on risks such as over-privileged access and supply-chain gaps, as well as product abuse and AI adoption, providing owners a clear basis to accept or mitigate each risk.
• Build quarterly security risk reporting and develop security risk content for leadership and board materials.
• Integrate security risk into Plaid’s enterprise risk management program so security risk is tracked and weighed alongside broader business risks.
• Support program maturity as scope grows, operating as an AI power user who automates parts of the workflow to help the program scale.
• Triage intake, conduct scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision.
• Collect updates on material risks, prepare the Security Risk Review, and build security risk content for executive and board decks.
• Partner with enterprise risk stakeholders to map security risks into the enterprise taxonomy, align rating scales, and keep registers synchronized.
• Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program expands.
• Ensure unmet FedRAMP rules and KSI gaps include a documented risk explanation and senior-official acceptance in the Security Decision Record, consistent with the risk register.
• Build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation, and share learnings with the team.

Requirements

• Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
• Technical depth to engage engineers on architecture and controls, with the ability to distinguish real exposure from hypothetical risk.
• Experience building or maturing a security risk program, including methodology, register, treatment and exception workflow, and key risk indicators.
• Experience integrating security risk into an enterprise risk management program.
• Experience preparing quarterly risk reporting and developing security risk content for executive and board decks.
• Ability to translate technical risk into a concise executive narrative without overstating or hand-waving.
• Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each.
• Power user who has built AI skills, agents, or automations that materially increase risk-program throughput and shares what works with the team.
• Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI).

Tools and frameworks

• NIST SP 800-30, FAIR
• NIST 800-53, NIST CSF, ISO 27001, SOC 2
• FedRAMP 20x
• Security Decision Record, SDR-CSO-FRR, SDR-CSX-KSI

Compensation and benefits

• Salary: USD 156,000 - 213,600 per year
• Additional compensation in the form(s) of equity and/or commission (dependent on the position offered)
• Medical, Dental, Vision
• 401(k)
• Pay is based on factors including scope and responsibilities, work experience and skillset, and location; pay and benefits are subject to change.

Location and employment

• Seattle, WA (hybrid)
• Seattle Office; New York City Office; Raleigh Office; San Francisco HQ
• Address: 1000 Dexter Avenue North, Suite 100A, Seattle, Washington, 98109
• Full time
• Department: All Departments - Risk - Eng