Whoop

5 days ago

Manager and Senior Manager: Governance, Risk, & Compliance (GRC)

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 10 hours agoStatus: Live

Job Summary

Lead the day-to-day execution and continuous evolution of the GRC program, aligning governance with ISO 27001, SOC 2, GDPR, and other regulatory frameworks. Build and manage scalable security control and risk programs, oversee third-party and SDLC risk assessments, and drive incident-response compliance improvements. Own GRC intake and triage, manage the enterprise risk register, coach analysts, and report operational KPIs and executive dashboards.

Location: Boston

Workplace: Onsite

Employment Type: Full time

Job Function: Legal, Risk & Compliance

Seniority: Sr. Manager level

Key Responsibilities

•Drive the development, implementation, and continuous evolution of the governance program to maintain alignment with ISO 27001, SOC 2, GDPR, and other regulatory frameworks.
•Develop and manage security control frameworks, policies, standards, and security awareness programs, including third-party risk assessment and SDLC assessment.
•Support incident response by ensuring regulatory requirements, breach documentation, and post-incident reviews are completed and translated into actionable improvements.
•Manage the enterprise risk register and lead enterprise risk reviews by running GRC intake, request triage, and complex assessments.
•Coach and mentor GRC analysts, lead third-party risk management due diligence, own GRC request operational intake/triage, and improve GRC tools/processes while reporting KPIs and executive dashboards.

Pay and Benefits

Salary: USD 155,000 - 205,000 annually

Equity and Bonus:Equity

Key Requirements

•8+ years of experience in GRC or information security, preferably in health tech, SaaS, or regulated environments, including ~4+ years managing GRC, compliance, audit, or cybersecurity professionals.
•Deep understanding of ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations for regulated or sensitive health data (including HIPAA where relevant).
•Experience managing or mentoring compliance, audit, or GRC professionals.
•Demonstrated experience leading operational GRC programs, including workload prioritization, KPI reporting, and cross-functional coordination.
•Strong understanding of cybersecurity controls, cloud security concepts, third-party risk assurance, and regulatory compliance requirements.

Experience:8+ yearsHealth techSaaSRegulated environments

Education:Bachelor's

Skills:CommunicationInterpersonal skillsOrganizational skillsDetail-orientedProject execution

Certifications:CISACISSPCRISCCIPP/EISO Lead AuditorHITRUST CCSFP

Company Brief

Whoop

Whoop designs and sells a subscription-based wearable fitness tracker and analytics platform that monitors recovery, strain, and sleep to optimize athletic performance and daily health for consumers and professional athletes.

Industry: Wearables

Company Size: Large (251 to 1,000 employees)

Growth: Scaleup

Valuation: Unicorn (USD 1B+)

Funding: Series E+

Headquarters: Boston, United States

Founded: 2012

Website LinkedIn

Loading job details...

Preparing the role view and application actions.

Whoop

5 days ago

Manager and Senior Manager: Governance, Risk, & Compliance (GRC)

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 10 hours agoStatus: Live

Job Summary

Location: Boston

Workplace: Onsite

Employment Type: Full time

Job Function: Legal, Risk & Compliance

Seniority: Sr. Manager level

Key Responsibilities

•Drive the development, implementation, and continuous evolution of the governance program to maintain alignment with ISO 27001, SOC 2, GDPR, and other regulatory frameworks.
•Develop and manage security control frameworks, policies, standards, and security awareness programs, including third-party risk assessment and SDLC assessment.
•Support incident response by ensuring regulatory requirements, breach documentation, and post-incident reviews are completed and translated into actionable improvements.
•Manage the enterprise risk register and lead enterprise risk reviews by running GRC intake, request triage, and complex assessments.
•Coach and mentor GRC analysts, lead third-party risk management due diligence, own GRC request operational intake/triage, and improve GRC tools/processes while reporting KPIs and executive dashboards.

Pay and Benefits

Salary: USD 155,000 - 205,000 annually

Equity and Bonus:Equity

Key Requirements

•8+ years of experience in GRC or information security, preferably in health tech, SaaS, or regulated environments, including ~4+ years managing GRC, compliance, audit, or cybersecurity professionals.
•Deep understanding of ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations for regulated or sensitive health data (including HIPAA where relevant).
•Experience managing or mentoring compliance, audit, or GRC professionals.
•Demonstrated experience leading operational GRC programs, including workload prioritization, KPI reporting, and cross-functional coordination.
•Strong understanding of cybersecurity controls, cloud security concepts, third-party risk assurance, and regulatory compliance requirements.

Experience:8+ yearsHealth techSaaSRegulated environments

Education:Bachelor's

Skills:CommunicationInterpersonal skillsOrganizational skillsDetail-orientedProject execution

Certifications:CISACISSPCRISCCIPP/EISO Lead AuditorHITRUST CCSFP

Company Brief

Whoop

Industry: Wearables

Company Size: Large (251 to 1,000 employees)

Growth: Scaleup

Valuation: Unicorn (USD 1B+)

Funding: Series E+

Headquarters: Boston, United States

Founded: 2012

Website LinkedIn