Principal Security GRC Analyst

About the Role

As a member of the Roblox Security Governance, Risk, and Compliance (GRC) team, you will play a key role in supporting the Security team’s mission. The GRC team empowers every builder to make risk-informed decisions by establishing governing policies and standards, a scalable method of assessing and quantifying risk, and formal oversight across Roblox.

Our program combines qualitative and quantitative risk management methodologies, including Factor Analysis of Information Risk (FAIR), to assess and prioritize security risks. GRC partners closely with Engineering, Legal, Finance, and leadership, providing reporting to the Board of Directors and the Audit & Compliance Committee.

This position is part of the Information Security team and reports to the GRC Manager.

Responsibilities

• Lead one or more program areas in our Governance, Risk, and Compliance team.
• Act as a key contributor to the larger Information Security Organization.
• Partner with GRC, Infosec, and Engineering colleagues to support the design and implementation of a "risk first" governance function.
• Identify opportunities to improve efficiency and effectiveness, designing tools and automations to drive security and compliance by design.
• Write, revise, and manage information security policies, standards, and procedures.
• Identify and assess information security risks, collaborating with engineering to implement and validate mitigating controls.
• Provide education and subject matter expertise across the Roblox organization.

Qualifications

• 10+ years of relevant professional experience in Security Governance, Risk and Compliance.
• Experience interfacing with software engineers to identify risks, map commitments to controls, and develop relevant policies.
• Experience assessing adherence to policies and developing mitigation and remediation plans.
• Deep understanding of risk assessment, compliance frameworks, policy creation, and educating organizations on these concepts.
• Understanding of security concepts and a broad range of security risks and controls.
• Experience in the tech sector with the ability to interface with engineers and establish credibility (coding is not required).

Work Arrangement

Roles based in an office are onsite Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday.