Role overview

WHOOP is seeking a Senior Governance, Risk, and Compliance Analyst to lead daily GRC program execution in a fast-paced, high-growth environment. You will manage cybersecurity and AI risk assessments, exceptions handling, software development lifecycle reviews, and security compliance processes while partnering with Legal, Security, Product, and other teams to reduce enterprise risk and strengthen operational resilience.

Key responsibilities

Lead structured cybersecurity, artificial intelligence, and technology risk assessments across systems, cloud environments, business processes, and major initiatives to evaluate threats, vulnerabilities, control effectiveness, and residual risk.
Maintain and operate the enterprise cyber risk register by drafting risk statements, tracking mitigation plans, and supporting governance and reporting processes.
Translate technical findings, architectural concerns, and control gaps into clear business risk scenarios that support executive decision-making and prioritization.
Support and help develop quantitative cyber risk analysis approaches such as FAIR to enhance how risk is measured and communicated across the organization.
Prepare materials and analysis to support the Cyber Risk Committee and executive risk reporting activities.
Partner with Security Architecture to assess risk in system designs, cloud architecture, identity models, data flows, and platform changes.
Collaborate with Security Engineering, Product Security, Legal, IT, and business teams to evaluate new initiatives, technology changes, artificial intelligence use cases, and third-party integrations through a risk lens.
Conduct risk assessments for emerging technologies including artificial intelligence and machine learning systems, evaluating data usage, model behavior, external dependencies, and security implications.
Develop dashboards and reporting that provide leadership with visibility into key cybersecurity risks and trends.
Contribute to the development and maturation of cyber risk management processes.

Requirements

Six or more years of experience in cybersecurity, enterprise risk management, information security, or a related field.
Demonstrated experience conducting structured cybersecurity or IT risk assessments.
Experience maintaining risk registers and tracking risk mitigation or treatment activities.
Deep understanding of security frameworks such as NIST CSF, ISO 27001, or PCI DSS, and familiarity with regulatory environments such as GDPR, HIPAA, or other privacy and data protection requirements.
Ability to translate technical findings into clear business risk for non-technical stakeholders.
Strong written and verbal communication skills with experience presenting findings to cross-functional teams.
Experience assessing risks related to artificial intelligence, machine learning systems, or emerging technologies, including familiarity with emerging AI governance frameworks such as NIST AI RMF or ISO/IEC 42001.
Professional certifications such as CRISC, CISSP, CISA, or CGRC are a plus.

What makes this role worth considering

This position is based in WHOOP’s Boston, MA office and offers a competitive base salary range of $130,000 to $170,000, along with meaningful equity and benefits. Equity serves as a key differentiator, allowing you to own part of WHOOP and share in the company’s long-term growth as it continues to build its performance analytics mission.