Lead Security Risk Engineer, Klaviyo

• Strong expertise in most of the following security domains: vulnerability risk management, application security, cloud infrastructure security, SaaS security, identity and access management, data security and access governance, platform and product safety
• Experience building security data products at scale, ideally using SQL and Snowflake, Airflow or Airbyte, and dbt
• Experience building and operationalizing security metrics with partner teams by using data visualization tools, ideally using Apache Superset
• Experience writing code to build on and integrate with web application APIs, ideally using Python and REST APIs
• A strong bias toward evidence, logic, math, and reason when communicating risk (instead of fear, uncertainty, and doubt)
• A strong bias toward “guardrails, not gates” and “paved security roads” philosophies (instead of rigid “centralized command-and-control” processes and operating styles)
• Excellent ability to plan, prioritize, and deliver results cross-functionally and in a timely fashion
• Proficiency discussing complex, nuanced topics with technical & non-technical audiences alike, especially software engineers
• Strong alignment with Klaviyo’s core values

Desirable

• We’re seeking a highly collaborative Lead Security Risk Engineer who will help us continue to evolve our Risk function by using engineering principles and data-driven strategies to precisely identify, understand, communicate, and prioritize mitigation of risk
• This role will start out primarily focused on supporting our security metrics program, with a big focus on data engineering and making security metrics easily accessible and highly impactful for stakeholders
• You’ll partner closely with Engineering, IT, Security, Leadership, and basically every other team at Klaviyo to create a holistic view of risk based on high-quality data about our assets, weaknesses, threats, and safeguards (controls)
• You will help evolve our risk management practices to be transparent, evidence-based, and centered around quantitative risk models
• Build and curate security metrics (KPIs, KRIs, KCIs) that provide actionable, real-time risk insights that answer meaningful business questions
• Automate and streamline third-party and internal security risk management processes
• Assist with risk management operations, including risk assessments and risk reviews
• Identify and assess risks using qualitative and quantitative methods, such as FAIR
• Co-create security standards and risk plans with InfoSec and partner team subject matter experts
• Provide mentorship and technical lead support to your fellow team members