Coinbase is looking for an experienced Security Risk Management Specialist to join the team. The Security Risk Specialist will help steer the security risk management program, enabling all security and privacy teams to manage and drive decision making about security risks. As the Security Risk Management Specialist, you hold domain expertise in security risk management standards and frameworks, especially quantitative risk frameworks, and will make these applicable and usable for fast-moving technical teams.

What you’ll be doing (ie. job duties)

• Analysis of multiple variables, including but not limited to, threat intelligence and risks, to inform threat models/risk scoring methodologies.
• Assessments: Facilitate technical security risk assessments across our production and corporate environments, enabling security and privacy teams to describe risk in both qualitative and quantitative terms
• Maintain the Security Risk Register data: quality control of data, tooling support and automation/process improvements
• Manage security risks via the risk lifecycle:
• Intake to the risk register, triage, residual risk calculation, and analysis with subject matter experts and risk owners
• Facilitate agreement and execution of mitigation plans across stakeholders
• Enable teams and leadership to risk-based decisions and trade-offs impacting, security investment strategies and project prioritization
• Document and monitor risk treatment decisions to accept or remediate risks
• Support reporting out on findings, metrics, and recommend mitigations to security and business leadership
• Ad-hoc meeting planning support for risk meetings with security leadership and business risk owners
• Communications/Training: Develop/maintain communication/training plans to roll out the security risk program across the organization
• Global Engagement: Collaborate with stakeholders to help scale the program’s risk framework across Coinbase entities, products, and geographies/markets
• Enterprise Risk: Work in lockstep with Enterprise Risk Management to escalate risks the enterprise risk register and report relevant metrics to senior leadership
• Legal: Regularly collaborate with GRCP teams, Legal and Compliance for risks, assessments, and reporting to meet regulatory requirements
• Audits: support data compilation to respond to US and international audit/regulator inquiries
• Industry pulse: Maintain awareness of international regulation, emerging threats, forecasts, policies, and benchmarks
• Maintain team runbooks, team intra-web pages, and risk register metrics dashboards

What we look for in you (ie. job requirements):

• 2-3+ years of experience working in Security Risk and/or GRCP/Compliance
• Has a credit risk, traditional finance or a financial modeling background
• Security Risk domain knowledge: security and cyber security risks, standards and frameworks i.e. ISO 27001/5, NIST CSF, FAIR risk quant methodology, etc.
• Experience with controls/risk management frameworks to measure controls/risks, monitor controls/risks, and validating/racking/evidencing remediation
• Ability to dig into technical risk solutions and to work on technical quantitative risk assessments
• Comfortable working with GRCP tools e.g. Jira, Archer etc. and quant and qualitative data analytics
• Ability to translate controls/risk standards out of compliance speak and into functional requirements
• Knowledge of risk/control best practices and knowledge of major regulatory/legal frameworks (US/international)
• Clear/concise communicator and writer; experience drafting/operationalizing project plans across stakeholders, holding teams accountable, and deliverables
• Ability to manage a queue against strategic priorities and shows expertise in being able to handle multiple assessments at a time
• You are willing to learn and apply processes unique to the challenges at Coinbase
• You are comfortable operating on an unpaved road and dealing with ambiguity
• Excellent organization and project management skills in a fast-moving and demanding environment
• Willingness to embrace a steep learning curve and stretch opportunities to learn new skills

Nice to haves:

• FinTech, TradFi, consulting, business operations technical program management or other customer-facing disciplines
• Strong knowledge of risk/control issues in relation to evolving technology (e.g., mobile, cloud, data lakes, machine learning)
• Security Risk: a certification is a plus, but not a requirement: information security risk management qualifications like CISA, CISSP, CISM, and FAIR.
• Coding knowledge a plus, but not a requirement e.g. learn to build data joins / integrations with GRCP tools and/or input requirements into tooling design plans
• Experience building risk/controls aligned to a standards framework
• Demonstrated beginner/intermediate knowledge of crypto/blockchain/web3

PID#: P60084