Senior Security Analyst, Security Risk Management

Seattle · Raleigh · San Francisco · New York City · Full-time · Hybrid · Posted Oct 12, 2026

At a glance

You will run security risk assessments end-to-end within Plaid's security risk management program across security, infrastructure, and product risk.
You will work with engineering SMEs and risk owners on risks ranging from over-privileged access and supply-chain gaps to product abuse and AI adoption.
You will build quarterly security risk reporting and the security risk content in leadership and board materials.

Run Security Risk Assessments: Triage intake, run scenario-based risk analyses with engineering SMEs, score initial and residual risk, and drive risk owners to a documented treatment decision.
Build Quarterly Risk Reporting: Gather updates on material risks, prepare the Security Risk Review, and build the security risk content for executive and board decks.
Integrate Security Risk into ERM: Partner with enterprise risk stakeholders to map security risks into the enterprise taxonomy, align rating scales, and keep the registers in sync.
Mature the Program: Help evolve the risk framework, register, key risk indicators, and risk-owner self-service as the program's scope grows.
Support FedRAMP 20x Risk Decisions: Help make sure unmet FedRAMP rules and KSI gaps carry a documented risk explanation and senior-official acceptance in the Security Decision Record, consistent with the risk register.
Scale Through AI and Automation: Build AI skills and automations for intake triage, first-draft risk analyses, register hygiene, and report generation—and share them across the team.

Experience running scenario-based analyses of technical risks (cloud, IAM, software supply chain, application and product) using NIST SP 800-30, FAIR, or a comparable method.
Technical depth to engage engineers on architecture and controls, and to tell a real exposure from a hypothetical one.
Experience building or maturing a security risk program—methodology, register, treatment and exception workflow, and key risk indicators.
Experience integrating security risk into an enterprise risk management program.
Experience preparing quarterly risk reporting and building security risk content for executive and board decks.
Ability to turn technical risk into a concise executive narrative without overstating or hand-waving.
Working knowledge of NIST 800-53, NIST CSF, ISO 27001, and SOC 2, and how risk management feeds each.
Power user who has built AI skills, agents, or automations that materially increase risk-program throughput—and who shares what works with the team.

Hands-on FedRAMP 20x experience, including Security Decision Record reporting for rules and Key Security Indicators (SDR-CSO-FRR, SDR-CSX-KSI).