Principal Security Engineer, GoDaddy

• The ideal candidate will gain the opportunity to shape a long-term security governance initiative, partner broadly across engineering and security teams, and drive meaningful improvements in how GoDaddy manages risk and audit readiness
• 10+ years of professional experience in information security, information technology, information technology audit, or related fields
• 6+ years of professional experience managing information security programs, audits, or formal assessment activities
• Experience building unified security controls frameworks across multiple compliance and regulatory standards
• Experience managing or performing audits using frameworks such as PCI DSS, NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, and SOC 2
• Experience assessing cloud environments such as AWS and applying core security engineering concepts such as threat modeling, architecture reviews, access management, and encryption
• Experience presenting audit results, risk posture, and remediation priorities to executive stakeholders
• Experience in automating, scripting, or designing automated compliance systems
• We encourage you to apply even if your experience or skillset doesn’t align perfectly with every requirement. We value a wide range of backgrounds and transferable skills, and we are excited to support learning and growth

Desirable

• The Governance, Risk, and Compliance team helps GoDaddy identify, assess, and address security risk across the business
• We lead regulatory and compliance audits, manage risk acceptances and exception workflows, support third-party risk activities, and define security standards and policies that guide teams across the company
• This role is a strong fit for someone who wants to build a durable audit and controls program from the ground up, influence security strategy, and work directly with senior leaders on risk-based decision-making
• Support a team of GRC compliance specialists in helping to build and manage a unified security controls framework that supports regulatory and industry compliance requirements
• Perform targeted gap assessments across business units to support new regulatory frameworks
• Partner with engineering, product, legal, and other security teams to identify control gaps, evaluate compensating controls, and reduce risk
• Support internal and external audits across frameworks such as PCI DSS, SOC 2, ISO 27001, and other applicable regulations
• Develop reporting and present security risks, audit status, and remediation priorities to senior leadership, including the Chief Information Security Officer
• Drive scalable risk-based processes for exception management, risk acceptance workflows, and broader governance initiatives
• Remove roadblocks across the team in addition to providing training and mentoring support across the team and within the larger information security organization