Program Manager, Ramp

• Minimum 5 years of experience with security requirements, standards, and practices, including NIST CSF, NIST 800-53, ISO 27001, PCI, SOC2, etc
• Minimum 3 years of experience in supporting business-enabling GRC programs in highly regulated industries (e.g., SaaS, Finance)
• Ability to lead end-to-end security audits from design and implementation of controls to audit execution and project management
• Excellent understanding of risks and ability to prioritize potential gaps and opportunities for improvement based on our business and risk profile
• Experience supporting and building out a comprehensive third-party risk management program
• Proficient risk management and communication skills to navigate difficult conversations with leadership while driving accountability for risk-based decisions
• Experience working with a range of customers to provide assurance on complex security concerns
• Demonstrated experience working cross-functionally across technical and non-technical teams across a large organization to drive alignment and action

Desirable

• This business-enabling role, you will have a direct impact on scaling and strengthening Ramp’s security and compliance practices
• You will drive initiatives across security compliance, third-party risk management, and assurance, with a focus on enhancing our security posture, supporting due diligence efforts, and advancing overall risk management strategies to support our rapid growth
• Support the governance risk and compliance management program to achieve reports/certifications such as SOC2, ISO 27001/2, PCI-DSS, SOX, and others as appropriate
• Perform targeted gap assessments to bridge existing processes with the requirements of additional frameworks critical for business expansion
• Manage risk program activities including risk registers, risk identification, tracking, and prioritization
• Assess identified security risks and collaborate cross-functionally to create and execute treatment plans aligned with business priorities
• Design and implement a common security control framework and ensure that controls are aligned with applicable security standards, regulations, and business objectives
• Support GRC tool implementation and optimization to streamline compliance processes and support security initiatives
• Support and optimize third-party risk management programs to evaluate and monitor vendor security practices
• Partner with Product, Engineering, IT, People Operations, and Legal to review existing and new initiatives that could impact compliance requirements
• Work with external auditors, regulators, and customers to ensure compliance with technology risk and compliance initiatives
• Work with the go-to-market team on customer security due diligence, including security questionnaires and resolving current or prospective compliance requests