Senior Staff InfoSec Risk Specialist (GRC)

The role

You will own the Security Risk Program by identifying, scoring, and driving down technical risk. You will build governance, automation, and review processes to create a predictive risk management capability.

What you will do

• Serve as the accountable owner for the Security Risk program
• Contribute to the GRC functional strategy and multi-year roadmap
• Own the escalation path end-to-end from notification to executive resolution
• Provide technical leadership and oversight for risk analysts
• Own the intake pipeline for risks from all sources
• Validate and baseline likelihood and impact scoring using ISO 27005-aligned methodology
• Enforce triage service levels and data quality
• Prepare and facilitate recurring risk reviews with security leadership
• Adjudicate risk treatment decisions
• Build and present Program Reviews to security and engineering leadership

Required qualifications

• At least 12 years of related experience with a Bachelor's degree; or 8 years with a Master's degree; or a PhD with 5 years of experience; or equivalent practical experience
• Expert-level knowledge across multiple cybersecurity domains
• Deep, hands-on experience with cybersecurity risk management
• Demonstrated experience building or substantially maturing a GRC function or program
• Experience mentoring and providing technical oversight to analysts
• Proven ability to communicate risk to executive audiences
• Working familiarity with at least one major compliance framework such as SOC 2, FedRAMP, ISO 27001, IRAP, C5, or similar
• Practical fluency with Jira, including JQL, custom field schemas, workflow design, and permission and issue-security models

Nice to have

• Experience running a risk register at scale
• Experience standing in for or acting as a deputy to a GRC leader
• Automation and data skills such as SQL, Python, Google Apps Script, Jira automation, or AI-assisted workflow tooling
• Background in a cybersecurity product company
• Experience assessing AI and machine learning risk
• Integrating threat intelligence into a formal risk management process
• CISSP, CRISC, CISA, CISM, or an ISO 27001 Lead Auditor or Lead Implementer credential

Benefits

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)
• Competitive leave benefits
• Gender-neutral parental leave
• Private medical, dental, and vision insurance
• Global home office allowance
• Internet or mobile phone allowance
• Hybrid work model with flexible hours
• Wellness programs
• In-office lunch program

About the company

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Their AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems.