Security GRC Specialist

The role

The Security GRC Specialist will advance cybersecurity risk management capabilities through continuous risk monitoring and data-driven assessment. This role develops scalable approaches to identify and monitor risks using technical signals and control performance data.

What you will do

• Develop and operationalize continuous cybersecurity risk management methodologies.
• Build and maintain data-driven risk models, indicators, and dashboards.
• Connect technical risk signals and control effectiveness data to business impact.
• Establish and improve cybersecurity risk assessment methodologies, registers, and scoring algorithms.
• Partner with Security and Engineering teams for runtime risk monitoring and automated risk signals.
• Collaborate with AI GRC to develop common risk assessment methodologies and reporting practices.
• Partner with the Control Assurance team to incorporate assurance findings into risk assessments.
• Identify systemic risk patterns and provide recommendations to improve risk posture.

Required qualifications

• 6+ years of relevant experience in cybersecurity, technology risk management, security engineering, or cybersecurity GRC.
• Demonstrated track record developing or implementing risk management methodologies, continuous monitoring capabilities, or data-driven security risk programs.
• Working knowledge of cybersecurity and AI governance frameworks (e.g., NIST CSF, NIST AI RMF, ISO 42001, ISO 27001) and relevant statutory/regulatory requirements.
• Direct experience collaborating with engineering teams to translate telemetry, control performance, or architectural data into risk insights.
• Strong expertise in cybersecurity risk management, security governance, or technology risk in high-scale technology environments.
• Hands-on experience with continuous risk monitoring, runtime risk assessment, security telemetry, risk analytics, or data-driven control effectiveness measurement.
• Proven ability to translate technical security signals, cloud vulnerabilities, and control deficiencies into meaningful business risk insights.
• Deep understanding of cybersecurity control frameworks, risk quantification/assessment methodologies, and residual risk management.
• Strong analytical, problem-solving, and cross-functional stakeholder management skills.
• Bachelor’s degree in a related field or equivalent professional experience.

Nice to have

• Technical background in security engineering, cloud security, application security, security architecture, or security analytics
• Experience in application security/product security in building Static and dynamic security testing tools, container scanning pipelines, open-source software vulnerabilities remediation pipelines, Kub
• Experience in writing java/spring boot applications in AWS and Kubernetes environment
• Experience in leading/mentoring other engineers to build a security or infrastructure service from scratch
• Experience identifying, testing, and remediating against vulnerabilities including those found in the OWASP Top 10 and CWE/SANS Top 25, writing exploits and verification

Benefits

• Annual bonus is 0-20% of the base salary
• Medical/Dental/Vision/Life, AD&D insurance
• Flexible Spending Accounts (FSA) & Health Savings Account (HAS)
• Long-term/Short-term Disability
• Employee Assistance Program (EAP) program
• 401K Plan with Company Match
• 18-21 days of Paid Time Off (PTO) a year based on the tenure
• 12 Paid Holidays
• Paid Parental leave
• Pre-tax commuter benefits
• MTV- [Free] Electric Car Charging Station

Before you apply

• Complete the attached Internal Transfer Request Form and submit.
• Apply with your Coupang e-mail address.

About the company

Coupang is a commerce company with a startup culture and the resources of a large global public company. They aim to build the future of commerce by disrupting the industry through innovation.