Security Controls Assurance Lead Jobs

About the Team The IT and Security organization builds the systems, data foundations, and automation that help OpenAI operate securely and reliably at scale. We support critical domains across identity, access, infrastructure security, enterprise systems, and internal productivity. As OpenAI grows, audit readiness and control assurance increasingly depend on reliable data: accurate system inventories, access populations, change records, configuration state, exception signals, and evidence generated directly from source systems. Our goal is to move beyond manual evidence collection and build scalable data products, automated validation, and continuous control monitoring that make security and IT controls measurable, repeatable, and defensible. About the Role We are looking for an IT Controls Data Engineer to build the data infrastructure that powers audit readiness, IT controls, evidence automation, and continuous control monitoring. In this role, you will design and maintain the pipelines, datasets, models, validation logic, dashboards, and evidence exports that make IT controls measurable, repeatable, and defensible. You will work across Security, IT, Infrastructure, Engineering, Finance Risk Management, and auditors to turn complex system behavior into reliable control data products. This is a technical builder role. The ideal candidate is strong in data engineering and analytics engineering, comfortable working with enterprise and security system data, and able to explain data lineage, source-system behavior, and control logic clearly to technical and audit stakeholders. You’ll be responsible for Building reliable data pipelines, models, and datasets for IT controls, including access, identity, configuration, change, ticketing, exception, and evidence data. Creating data quality, lineage, reconciliation, and completeness checks that make control data defensible for SOX and other audit use cases. Designing automated evidence generation workflows that produce compl

We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products. Plaid powers the tools millions of people rely on to live a healthier financial life. We work with thousands of companies like Venmo, SoFi, several of the Fortune 500, and many of the largest banks to make it easy for people to connect their financial accounts to the apps and services they want to use. Plaid’s network covers 12,000 financial institutions across the US, Canada, UK and Europe. Founded in 2013, the company is headquartered in San Francisco with offices in New York, Washington D.C., London and Amsterdam. About the Team: The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls. Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners. We partner closely across the company to ensure Plaid’s platform remains secure, resilient, and aligned with industry and regulatory expectations. The Security Contracts workstream is a core part of our Security Assurance and Trust Enablement program — ensuring Plaid's contractual security obligations with customers and data partners are defensible, consistent, and never a bottleneck to deal velocity, all while building trust. About the Role You will own Plaid’s Security Contracts workstream end-to-end—the DRI for how security contract reviews get done, how fast they move, and how the program improves over time. You will review security provisions in customer MSAs, DPAs, and security addenda, identify unacceptable clauses, and provide Legal and GTM with the actionable security feedback they n

About the Team Governance, Risk, and Compliance (GRC) is foundational to Security delivering mission outcomes at OpenAI. The GRC team provides security assurances and builds compliance for OpenAI’s technology, people, and products. We are technical in what we build but operational in how we do our work, and we partner deeply with Product, Security, Legal, Privacy, GTM, and Field Security to help OpenAI move quickly while maintaining trust with customers, auditors, regulators, and the public. About the Role We are looking for an experienced Product Lifecycle Assurance IC to help scale OpenAI’s GRC function across our product stack to ensure products address customer and regulatory compliance requirements at launch and regressions are detected promptly and corrected. You will partner closely with Product, Security, Legal, and Privacy teams to make sure OpenAI can move quickly while maintaining our security, privacy and compliance claims and giving customers, auditors, and regulators assurance about how OpenAI handles user data. You are responsible for product assurance end-to-end from inception to post-launch (continuous) monitoring. You leverage existing workflows, reviews, and data and enhance, augment and build the components needed to create an end-to-end product assurance program. This role is not about supporting SOC or ISO audits; it's a highly cross-functional and deeply technical operations role to ensure that OAI products meet the compliance bar at launch, regressions are prevented and detected, and our compliance state can be evidenced. This role also helps ensure that our product launch governance program operates effectively across key safety, privacy, legal and security stakeholders and lessons-learned from incidents and regressions are used to improve the program. You or in partnership with engineering teams, build key controls in our infrastructure stack, developer workflows and launch tooling to provide developers with guardrails, perform CI/CD confor

About the Team Governance, Risk, and Compliance (GRC) is foundational to Security delivering mission outcomes at OpenAI. The GRC team provides security assurances and builds compliance for OpenAI’s technology, people, and products. We are technical in what we build but operational in how we do our work, and we partner deeply with Product, Security, Legal, Privacy, GTM, and Field Security to help OpenAI move quickly while maintaining trust with customers, auditors, regulators, and the public. About the Role We are looking for an experienced Product Lifecycle Assurance IC to help scale OpenAI’s GRC function across our product stack to ensure products address customer and regulatory compliance requirements at launch and regressions are detected promptly and corrected. You will partner closely with Product, Security, Legal, and Privacy teams to make sure OpenAI can move quickly while maintaining our security, privacy and compliance claims and giving customers, auditors, and regulators assurance about how OpenAI handles user data. You are responsible for product assurance end-to-end from inception to post-launch (continuous) monitoring. You leverage existing workflows, reviews, and data and enhance, augment and build the components needed to create an end-to-end product assurance program. This role is not about supporting SOC or ISO audits; it's a highly cross-functional and deeply technical operations role to ensure that OAI products meet the compliance bar at launch, regressions are prevented and detected, and our compliance state can be evidenced. This role also helps ensure that our product launch governance program operates effectively across key safety, privacy, legal and security stakeholders and lessons-learned from incidents and regressions are used to improve the program. You or in partnership with engineering teams, build key controls in our infrastructure stack, developer workflows and launch tooling to provide developers with guardrails, perform CI/CD confor

For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day. Smartsheet maintains certifications and attestations across SOC 2 Type II, the ISO 27001/27017/27701/22301 suite, HIPAA, and other commercial compliance frameworks—and the manual work of proving those controls quarter after quarter doesn't scale with the business. We're looking for a Sr. Security Engineer I to bring an engineering mindset to our commercial GRC program: automating control monitoring, building evidence pipelines, and reducing the audit-season scramble into a default state of readiness. You'll work hands-on with our GRC platform, cloud, and identity tooling to make control evidence collect itself wherever possible, and you'll partner closely with engineering teams to translate compliance requirements into technical control logic they can actually build against. This is a builder's role within GRC—less checklist administration, more systems thinking applied to compliance. Our approach is grounded in GRC Engineering principles: automate early and often, treat controls and their mappings as code, favor continuous assurance over periodic checks, and build compliance that engineers can consume as easily as they contribute to it. This role reports to the Senior Director, GRC Engineering and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer. You Will: Own control automation for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks: design and build automated evidence collection and continuous control monitoring across cloud, ident

We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products. Plaid powers the tools millions of people rely on to live a healthier financial life. We work with thousands of companies like Venmo, SoFi, several of the Fortune 500, and many of the largest banks to make it easy for people to connect their financial accounts to the apps and services they want to use. Plaid’s network covers 12,000 financial institutions across the US, Canada, UK and Europe. Founded in 2013, the company is headquartered in San Francisco with offices in New York, Seattle, Washington D.C., Raleigh, London, and Amsterdam. Team: The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls. Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners.We partner closely across the company to ensure Plaid’s platform remains secure, resilient, and aligned with industry and regulatory expectations. Third-party ecosystem risk is a core part of how we keep Plaid safe—we vet the security of both the vendors we rely on and the customers and partners who connect to our platform, so trust runs in both directions. Role: You will run security risk assessments for Plaid’s third parties end-to-end—from intake and questionnaire through risk rating, findings, and tracked exceptions. You will assess the security posture of customers and partners onboarding to the platform with the same rigor we apply to vendors. You will keep the third-party risk lifecycle moving—risk tiering, reassessment cadence, remediation follow-through, and a clean, current

Senior Compliance Specialist Position Description SingleStore is building a real-time data platform that helps organizations transact, analyze and act on data in a single system. We are committed to operating with strong security, privacy and resilience standards across our products, services and internal operations. We are seeking an experienced and highly motivated Senior Compliance Specialist to help scale our security, privacy and compliance programs. This role will be responsible for maintaining key certifications, driving cross-functional compliance initiatives, overseeing development and management of our privacy program, supporting compliance with the Digital Operational Resilience Act (DORA), and helping mature our Business Continuity Management System (BCMS). The ideal candidate is practical, organized and collaborative, with experience translating regulatory and framework requirements into durable operational processes across technical and business teams. Job Responsibilities Support governance activities across the security, privacy and compliance program, including maintaining Information Security Management System documentation, evidence, policies, procedures and audit trails. Help maintain and improve active certifications and attestations such as ISO/IEC 27001, SOC 2 Type II, HIPAA and PCI DSS, while coordinating with stakeholders across the business to ensure ongoing compliance. Drive readiness efforts for new compliance objectives, certifications and customer-driven assurance requirements. Participate in enterprise risk management activities, including risk methodology, risk assessments, treatment planning and follow-up with risk owners. Oversee the development, implementation and ongoing management of SingleStore’s privacy program in partnership with Legal, Security, IT and business stakeholders. Support compliance with applicable privacy and data protection requirements, including operationalizing controls and processes needed to meet regu

We’re looking for an Associate Legal Counsel, Commercial and Privacy to contribute in developing a world class privacy program at Hootsuite and supporting on sales and other commercial matters. As part of our Privacy, Compliance & Customer Assurance team, you'll be helping translating complex global privacy laws into practical advice for business stakeholders and helping the Commercial Legal team drive deals across the line. This is a remote-first role and is open to applicants located in provinces and states where we are set up to hire. In this role, you will report to the Senior Legal Counsel, Privacy, AI & Compliance. Please include a cover letter when applying. WHAT YOU’LL DO: Provide frontline privacy support to business stakeholders throughout the organization (e.g., product development, sales, marketing, people, etc.) Draft privacy and other legal policies, notices and guidance Support our Customer Assurance function (which provides security and privacy sales support) and efficiently respond to customer data protection and privacy questions Draft, review, and negotiate commercial and data protection agreements, including, data processing agreements, NDAs, SaaS agreements, and vendor agreements Collaborate with key stakeholders to implement and maintain key privacy initiatives (e.g., improvements to our data retention / deletion policies, PIAs, data inventories, vendor controls, data subject requests) Collaborate with key business stakeholders to identify privacy risks and implement business minded solutions Support the implementation and maintenance of Privacy and Customer Assurance operations tools and processes in collaboration with the team and other stakeholders. Provide business oriented and practical legal guidance and support on a wide range of topics, including commercial contracts (with a focus on SaaS contracts), data protection, and procurement. Build and maintain positive relationships with

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world's largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team Stripe Infrastructure is responsible for the reliability, scale, performance, and cost of Stripe's systems and the productivity and sentiment of Stripe's people. You may work on a wide variety of critical business areas including Core Infrastructure—We're the home for Stripe's critical tier-0 infrastructure systems (Compute, Networking, DocumentDB, Distributed Caching, and High assurance engineering). We build the foundational platform for Stripe products and services to allow them to operate at scale. We drive reliability, availability, efficiency, and scalability of these systems. Developer Infrastructure—We're responsible for the productivity of all developers at Stripe. We ensure Stripe's engineers have a reliable inner dev loop to maximize productivity while building everything from low-latency microservices to large-scale data pipelines and machine learning models. Security—We're a newly formed security team tasked with building the guardrails to extend Stripe's secure platform, allowing engineers to leverage new technologies that best meet their needs. We work on enabling new technologies for product and platform teams, prioritizing business needs as well as building the tooling and controls that further enable self-serve, guaranteeing we maintain a high bar across all Stripe surfaces with security in-built into foundations. Application and Revenue Platform—We build the powerful and scalable infrastructure that powers the company's ap

About Pinterest: Millions of people around the world come to our platform to find creative ideas, dream about new possibilities and plan for memories that will last a lifetime. At Pinterest, we’re on a mission to bring everyone the inspiration to create a life they love, and that starts with the people behind the product. Discover a career where you ignite innovation for millions, transform passion into growth opportunities, celebrate each other’s unique experiences and embrace the flexibility to do your best work. Creating a career you love? It’s Possible. At Pinterest, AI isn't just a feature, it's a powerful partner that augments our creativity and amplifies our impact, and we’re looking for candidates who are excited to be a part of that. To get a complete picture of your experience and abilities, we’ll explore your foundational skills and how you collaborate with AI. Through our interview process, what matters most is that you can always explain your approach, showing us not just what you know, but how you think. You can read more about our AI interview philosophy and how we use AI in our recruiting process here . Pinterest’s Security team (Pinfosec) is seeking an IC14 Security Engineer - Security Governance, Risk & Compliance (GRC Senior Analyst) to support and strengthen our security governance and assurance programs. This role is ideal for someone who is detail-oriented, collaborative, and motivated by building scalable security processes that help the business manage risk effectively. Reporting to the Interim Head of Security Governance, Risk & Compliance, this individual contributor will partner closely with Security, Engineering, IT, Legal, Internal Audit, and other cross-functional stakeholders to help maintain and improve Pinterest’s security control environment. The role will contribute to core GRC activities including risk management, policy governance, control testing, audit support, awareness tracking, and internal risk assessmen

Location: Remote (U.S.) Clearance: Ability to obtain and maintain a Public Trust Salary Range: 100K – 120K LTS is seeking a skilled and mission-focused Cyber Security Engineer to support a major modernization initiative within the Department of Veterans Affairs (VA) health portfolio. This role will support cybersecurity engineering, risk management, and security modernization efforts across enterprise healthcare systems and infrastructure environments supporting Veteran healthcare operations nationwide. The ideal candidate will possess strong experience securing complex federal IT systems, supporting cloud and hybrid environments, and implementing cybersecurity solutions aligned with federal compliance frameworks and Zero Trust initiatives. This individual will work closely with infrastructure, application, integration, and DevSecOps teams to ensure modernization efforts are designed and deployed with security at the forefront. What You’ll Do: • Support cybersecurity engineering for the pilot, including cloud security, RMF/ATO support, compliance documentation, and continuous monitoring. • Secure AWS-based environments through identity and access management, encryption, logging, monitoring, network security, vulnerability management, and configuration hardening. • Configure, monitor, and support AWS security services such as AWS Network Firewall, Security Hub, GuardDuty, CloudWatch, CloudTrail, Inspector, and related capabilities. • Support security planning for an AWS Commercial Cloud environment with consideration for future migration to AWS GovCloud or another VA-approved hosting environment. • Assist with ATO planning, control implementation, evidence collection, compliance reporting, and approval workflows. • Work within eMASS, ServiceNow GRC, or similar risk management systems to support ATO artifacts, information assurance tasking, POA&M tracking, and security documentation. • Develop and maintain SSPs, POA&Ms, SOPs, risk assessments, control n

About Ubiquiti At Ubiquiti Inc., we create technology platforms for Businesses, Smart Homes, and Internet Service Providers, driven by our goal to connect everyone, everywhere. To date, Ubiquiti has shipped over 100 million devices worldwide, from ISP networking products to next generation of IT solutions. Our growth is made possible by the dedicated team of hundreds behind the scenes. From software developers and product managers to designers and strategists, Team UI is driven to achieve our common goal: Rethinking IT. At Ubiquiti, you’ll heighten your potential and broaden your horizons - all while shaping the future of connectivity. Ubiquiti Prague R&D team is looking for experienced Embedded Firmware Engineer (Access). Candidates should be prepared to work from our Prague office at least two times per week. Responsibilities: Work as part of a global, cross-functional team of firmware, hardware, and product engineers to develop cutting-edge access control products and technologies Design, implement, and maintain embedded firmware for current and next-generation access devices (readers, hubs, controllers) Enhance and optimize existing firmware for performance, stability, and security Participate in code reviews to ensure adherence to best practices and maintain high code quality standards Collaborate closely with BSP, Hardware, Backend, Mobile, and Product Assurance (PA) teams throughout the product development lifecycle Diagnose, troubleshoot, and perform root-cause analysis of firmware and system-level issues Support manufacturing and production validation by resolving firmware-related issues and assisting with firmware update pipelines Requirement (Must-Haves): 3+ years embedded firmware development experience with C Good knowledge of network protocols (TCP/IP, HTTP, Websocket, TLS/SSL) Experience with microcontrollers, SoCs, embedded Linux and RTOS Experience with access control systems (e.g., card readers, NFC, mobile unlocking) Knowledge of Git vers

At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done. Snowflake is about empowering enterprises to achieve their full potential, and people too. With a culture that's all in on impact, innovation, and collaboration, Snowflake is the sweet spot for building big, moving fast, and taking technology and careers to the next level. As an Account Executive on our UK Public Sector team, you will own the Defence territory: selling the Snowflake AI Data Cloud to the Ministry of Defence, defence primes, system integrators, and allied national security organisations. This is a mission-driven, field-based role for someone who understands how data transforms Defence outcomes and can navigate the sensitivities of secure and sovereign environments. As an Account Executive you will: Prospect, win, and onboard net-new Defence logos across the UK, breaking into MOD commands, defence primes, and strategic SIs that are not yet Snowflake customers Run complex, consultative sales cycles that align the Snowflake AI Data Cloud to mission priorities such as readiness, logistics, intelligence, and command and control Position Snowflake Cortex AI, Snowpark, and secure data sharing for sovereign, air-gapped, and high-assurance workloads Partner with Solution Engineers to design architectures that meet Defence security, residency, and accreditation require

About the opportunity We are seeking an Information Security Controls Manager to join the Information Risk Management (IRM) Segment within the Information Security (IS) Controls team at N26. As a member of this team, you will contribute to ensuring that Information Security Controls Framework processes are operated without any disruptions, with a specialized focus on strengthening our Cloud Security posture and AI Governance frameworks. N26 and its subsidiaries operate in a variety of regulatory environments and across international boundaries, while the IRM team helps N26 to navigate this complex, demanding, and rapidly evolving technological landscape. In this role, you will: Frequently communicate with various stakeholders of all levels. Execution and review of the Information Security (IS) Controls Framework monitoring process, ensuring comprehensive coverage of cloud infrastructure and AI/ML deployments. Communicate, Collate and review the evidence received via monthly control review request tickets (TOE). Perform QA reviews, query and or seek clarification from stakeholders to achieve the objectives of controls effectiveness. Highlight the gaps/risks observed during reviews, raise non-conformities, particularly concerning cloud misconfigurations and AI model risks, and suggest improvements to the teams or stakeholders. Liaise with the CISO office and the DPO office to provide updates on a monthly basis over the status of controls, including compliance updates regarding cloud security and AI systems. Improve awareness of controls, security practices, and responsible AI utilization among stakeholders. Contribute to the team in developing KRIs tailored to traditional IT, Cloud environments, and AI use cases. Working independently and managing the IS Controls daily tasks. Review and update the design of the controls pages from a technical perspective and maintain the control calendar. Actively work on the change requests from stakeholders. Preparation and follow-u

About the Team OpenAI’s Cyber team works to make frontier AI safe, trusted, and transformative for developers and enterprises. This team is building the security foundation for Codex: the native controls that govern what Codex can access and do, and the interfaces that allow customers and security partners to inspect, constrain, approve, and respond to Codex activity. Our goal is to make Codex secure by default, governable by enterprises, and interoperable with the security products customers already trust . This extends the existing product direction around tenant-scoped tools, guarded actions, approval systems, and scalable partner interfaces. About the Role We are looking for a deeply technical Product Manager to help build Codex security controls and the partner ecosystem around them. This role focuses on securing Codex itself : how identity, permissions, tools, MCP servers, repositories, secrets, networks, and high-impact actions are governed across Codex products. You will also help define standard interfaces through which authorized customer and partner systems can provide security context, inspect activity, return policy decisions, receive telemetry, and initiate bounded responses. You will work closely with Codex product and engineering, OpenAI Security and Safety, enterprise customers, and partners across application security, identity, cloud security, data security, infrastructure, and security operations. In this Role you Will Build native security controls for Codex Partner with engineering, design, security, and safety teams to develop controls for: Identity, roles, permissions, and tenant isolation. Access to repositories, files, tools, MCP servers, secrets, networks, and infrastructure. Read, write, execute, and deployment authority. Human and policy-based approvals. Prompt-injection and untrusted-content defenses. Audit trails, provenance, stop conditions, revocation, and rollback. Help establish a graduated authority model in which local, read-only