The opportunity
The Stripe Security team is dedicated to improving the security of Stripe and its users. Our users trust us with some of their most sensitive information, and we make security a first-class consideration in everything we do.
What you'll do
Independently manage a portfolio of Third Party Security Risk Assessments: (TPSRAs) for new engagements, renewals / reassessments, and material changes in relationship scope.
Review security questionnaires, independent assurance reports,: certifications, penetration-test results, and other evidence to evaluate third-party control effectiveness.
Identify security gaps, determine proportionate remediation requirements, and: clearly communicate findings to Stripe DRIs and cross-functional partners.
Apply Stripe’s third-party security standards consistently, documenting: assessment results, decisions, and supporting evidence in Zip, Aravo, and other program systems.
Escalate novel, complex, or high-risk findings and support Enhanced Due: Diligence and risk-acceptance processes when a third party cannot meet Stripe’s security requirements.
Partner with Procurement, Legal, Privacy, Business Continuity, Security, and: business stakeholders to resolve assessment issues and support timely third-party onboarding.
What they're looking for
- Provide practical guidance to Stripe teams on TPSRA requirements, timelines,: and their responsibilities throughout the assessment process.
- Track assessment volume, aging, service levels, remediation status, and other: program-health indicators; use the data to identify trends and recommend improvements.
- Identify gaps in program processes, documentation, or tooling and contribute: to implementing improvements that increase consistency, scalability, and stakeholder experience.
- Contribute to third-party security risk policies, standards, procedures, and guidance.
