Program Manager, Security GRC

About the role

Stripe is a financial infrastructure platform for businesses. The Security Governance, Risk, and Compliance team provides governance, risk management, and compliance capabilities to Stripe and its partners. The Program Manager will own coordinating audits, interfacing with regulators and auditors, and ensuring global compliance obligations are met with consistency.

What you'll do

• Act as information security SME during cross-functional audit engagements and walkthroughs with auditors and regulators.
• Serve as the internal liaison between regulators and the Security organization to ensure audits are managed consistently.
• Create and maintain a central repository of audit evidence for SOC 2, PCI DSS, SOX, and other standards.
• Perform security risk and control assessments against frameworks to ensure compliance with Stripe policies and applicable regulations (ISO 2700x, PCI DSS, SOX, NIST, COBIT).
• Support control owners with guidance on security control design and remediation across time zones.

What they're looking for

• Subject matter expert in information security frameworks, practices, policies, standards, and procedures (e.g., NIST CSF, SOC 2, PCI DSS, ISO 27001/2).
• 6+ years of experience in Security Governance, Risk, and Compliance or Technology Compliance with strong audit experience.
• Exposure to global regulatory requirements (DORA, FFIEC, EBA, NYDFS) and experience integrating them into programs.
• Experience conducting security audits and supporting compliance across multiple overlapping regulatory frameworks.
• Strong program management skills coordinating security assessments and managing multiple stakeholder engagements across time zones.
• Excellent communication skills and ability to translate technical security concepts for auditors, regulators, and executives.

For applicants in Nigeria

• The listing states worldwide eligibility and remote work; Nigeria is eligible to apply.
• The listing does not state a timezone requirement; confirm before interviewing.
• The listing does not specify contractor versus employee status; confirm before interviewing.
• The listing does not include pay currency or range; confirm before interviewing.
• The listing does not mention visa or work authorization requirements; confirm before interviewing.