← All roles

Senior Staff InfoSec Risk Specialist (GRC)

SentinelOne· GRC
Apply on company site
Hybrid (Global)Full-timePosted 4w ago

About the role

Senior-level information security risk professional responsible for owning and maturing SentinelOne's Security Risk Program, delivering predictive risk management, and leading risk analysis, governance, and automation initiatives across the organization.

Responsibilities

  • Serve as the accountable owner for the Security Risk program, covering cadence, scoring methodology, reporting, escalation, and the standard operating procedure that governs it, ensuring audit-readiness with decisions documented, approvals logged, procedure current, and evidence retrievable.
  • Contribute to the broader GRC functional strategy and multi-year roadmap, advising leadership on how risk register data should inform security investment and resourcing decisions.
  • Own the escalation path end-to-end, from critical-risk notification through executive resolution of cross-team prioritization conflicts, and provide day-to-day technical leadership and oversight for risk analysts at all levels.
  • Own the intake pipeline for risks from internal observation, audit findings, penetration tests, red team exercises, vulnerability scans, threat modeling, tabletop exercises, incidents, and compliance frameworks (SOC 2, SOX, FedRAMP, IRAP, C5, UK Cyber, NIST CSF).
  • Validate and baseline likelihood and impact scoring using an ISO 27005-aligned methodology and defend those ratings to engineering and security stakeholders.
  • Enforce triage service levels (same-day escalation for critical risks, expedited handling for next tier, bi-weekly for others) and maintain data quality across the risk register.
  • Prepare and facilitate recurring risk reviews with security leadership and drive mitigation plans to approval, ensuring critical risks have approved plans within the program’s window.
  • Adjudicate risk treatment decisions, document residual risk, and re-score rather than closing out prematurely.
  • Build and present the Program Review to security and engineering leadership, covering status, trends, and upcoming quarter priorities, and baseline the register against new results and threat landscape.
  • Build repeatable automation and AI-assisted workflows to generate review prep and quarterly metrics, and extend the risk register to emerging domains (including AI risk) while integrating threat intelligence.

Qualifications

  • 12+ years of related experience with a Bachelor's degree; or 8+ years with a Master's; or a PhD with 5+ years of experience; or equivalent practical experience.
  • Expert-level knowledge across multiple cybersecurity domains (application security, cloud security, IAM, network security, data protection, endpoint security, third-party risk) with depth in multiple niches.
  • Hands-on experience with cybersecurity risk management (identification, qualitative/quantitative scoring, treatment decisions, residual risk, remediation tracking) grounded in ISO 27005, ISO 27001, NIST RMF, NIST CSF, or FAIR.
  • Proven track record of building or maturing a GRC function and leading cross-team projects with minimal supervision.
  • Experience mentoring and providing technical oversight to analysts, including senior analysts.
  • Ability to communicate risk to executives, translating technical findings into business impact and defending recommendations.
  • Familiarity with major frameworks (SOC 2, FedRAMP, ISO 27001, IRAP, C5) and practical fluency with Jira (JQL, custom fields, workflows, permissions).
  • Experience running risk registers at scale in large distributed engineering orgs; ability to deputize for a GRC leader in incidents.
  • Automation and data skills (SQL, Python, Google Apps Script, Jira automation, AI-assisted workflows) to automate reporting.
  • Background in cybersecurity product companies or environments with external security scrutiny.
  • Experience assessing AI/ML risk or integrating threat intelligence into risk management; relevant certifications (CISSP, CRISC, CISA, CISM, ISO 27001 Lead Auditor/Lead Implementer) preferred.

Skills

Required:Security Risk Program ownershipRisk scoring and ISO alignmentRisk governance and escalationGRC program building/maturingCommunication to executives
Nice to have:Jira/JQL and workflowsAutomation and data skillsAI risk assessment

Benefits

  • Restricted Stock Units (RSUs)
  • Employee Stock Purchase Plan (ESPP)
  • Competitive leave benefits
  • Gender-neutral parental leave
  • Private medical, dental, and vision insurance
  • Global home office allowance
  • Internet or mobile phone allowance
  • Hybrid work model with flexible hours
  • Wellness programs
  • In-office lunch program
Last updated Oct 22, 2026. Interested? Apply on the company site.
SentinelOne logo

About SentinelOne

AI-Powered Enterprise Cybersecurity Platform

SentinelOne unifies AI-powered endpoint, cloud, identity, and data protection—enhanced by our Security Data Lake for seamless and efficient cybersecurity.

CybersecurityAI SecurityEndpoint SecurityCloud SecurityAI-SIEMIdentity SecurityEDRXDR
Company profileWebsite

More open roles at SentinelOne