Senior Risk & Compliance Engineer, Instacart

• 7+ years of progressive experience in third-party security risk management, vendor audits, or compliance roles, preferably within a technology company
• Hands-on experience with third-party risk management (TPRM) and Governance, Risk, and Compliance (GRC) tools (e.g., OneTrust, Archer, Prevalent, Process Unity, Venminder, BitSight, SecurityScorecard, Zip, Safe Security)
• Expertise in leading compliance standards and industry frameworks (e.g., GDPR, CCPA, SOC2, NIST, ISO 27001)
• Familiarity with common security concepts, including identity and access controls, firewalls, APIs, vulnerabilities (CVE), and software supply chain risks
• Proven ability to review and analyze a variety of vendor security documentation, including audit reports, vulnerability scans, and penetration test results
• Previous experience with consumer data protection and privacy risk management, including performing privacy risk assessments and suggesting mitigation plans
• Strong communication and stakeholder engagement skills, with a proven ability to influence decision-makers and articulate complex technical risks and control concepts to non-technical stakeholders, including senior executives and audit committees

Desirable

• Join Instacart’s Governance, Risk, and Compliance (GRC) team as a Risk & Compliance Engineer specializing in Third Party Risk Management
• In this critical role, you will be at the forefront of safeguarding Instacart’s security and privacy posture by managing risks associated with our extensive network of third-party vendors, suppliers, and service providers
• You will oversee the entire vendor lifecycle, conducting robust due diligence during onboarding, performing comprehensive recurring reviews, and managing offboarding procedures to assess and quantify third-party information security and privacy risks
• Your responsibilities will include identifying and mitigating emerging security risks introduced by technologies such as Artificial Intelligence (AI), Large Language Models (LLMs), data lakes, and data warehouses
• Collaborating across teams, you’ll influence decision-makers to mitigate risks while enabling secure business growth
• This is an exciting opportunity to drive innovation through advanced risk quantification using models like FAIR-TAM , cutting-edge tooling, and strategic partnerships within Instacart’s diverse, global vendor ecosystem
• Your work will directly inform Instacart’s broader security strategies by ensuring vendors align their controls with Instacart’s expectations and stringent regulatory compliance requirements, including GDPR, CCPA, ISO 27001, NIST, and SOC 2
• Reviewing third-party vendors during onboarding due diligence and recurring evaluation processes, meticulously focusing on identifying and mitigating cybersecurity, data privacy, and compliance risks
• Operating and improving Instacart's third-party risk management systems, including leveraging tools like Zip for workflows and Safe Security for risk quantification
• Partnering with Legal, Security Engineering, and system owners to embed comprehensive security and privacy requirements directly into third-party contracts and agreements, ensuring alignment with Instacart policies and compliance frameworks (e.g., GDPR, CCPA, SOC2, NIST, etc)
• Liaising with high-tier vendors to understand their security posture, advocate for aligned improvements, and provide advisory on identified risks
• Developing and maintaining processes that enhance the efficiency and scalability of third-party evaluations, continuous monitoring, and offboarding procedures
• Identifying and quantifying risks, proposing effective mitigation measures, and influencing internal stakeholders to implement necessary security controls to improve the third-party risk posture
• Leading vendor risk documentation, including maintaining a comprehensive third-party risk register, developing risk quantification reports using models like FAIR-TAM, and presenting findings, trends, and action plans for senior leadership
• Working with internal security teams to investigate and respond to third-party-related security incidents, defining escalation procedures and remediation requirements