Building the Future of Open Finance

Payward, the parent company behind Kraken, has spent 15 years building a global financial infrastructure platform. Kraken is one of the world's longest-standing crypto platforms, trusted by over 10 million individuals and institutions.

The Team

Kraken's Security Team is seeking a Senior Risk Analyst to join the Security Governance, Risk, and Compliance (SecGRC) team. Reporting to the Senior Manager of Security Risk Management, this role is key to executing and maturing Kraken's Security Risk Management program. You will conduct rigorous risk assessments, produce high-quality analysis, and help build the operational infrastructure for the program.

The ideal candidate is deeply analytical, process-minded, and energized by turning ambiguous risk signals into clear, repeatable, and scalable workflows. An entrepreneurial spirit and comfort with iterating quickly is a must.

The Opportunity

• Execute security risk assessments end-to-end, including scoping, data gathering, analysis, findings documentation, and stakeholder communication.
• Support the development and continuous refinement of risk assessment templates, workflows, and process guides.
• Maintain risk registers and ensure identified risks are tracked accurately through mitigation, remediation, or acceptance workflows.
• Assist in building and maintaining Key Risk Indicator (KRI) tracking and risk reporting outputs.
• Partner with technical teams (Vulnerability Management, Application Security, Blue Team) to gather risk-relevant data.
• Identify opportunities to streamline and automate risk processes.
• Contribute to the documentation and upkeep of risk program standards, procedures, and guidance materials.
• Collaborate with cross-functional teams (Compliance, Internal Audit, Engineering, Legal) to ensure risk findings are well-contextualized and actioned.
• Support audit preparedness activities and risk-related reporting.

What You Bring

• 5+ years of experience in information security risk management, cybersecurity governance, or GRC.
• Hands-on experience conducting risk assessments and owning findings documentation.
• Strong working knowledge of risk management frameworks such as NIST CSF, ISO 27005, PCI DSS, or DoCRA.
• Demonstrated ability to build repeatable, structured, and scalable processes.
• Strong data analysis skills; able to clean, interpret, and present risk data clearly and accurately.
• Experience contributing to KRI tracking and risk reporting.
• Familiarity with GRC tools such as AuditBoard, Archer, OneTrust, or ServiceNow GRC.
• Proficient in Google Workspace; SQL and/or Tableau experience is a strong plus.
• Excellent written communication skills.
• Self-directed and comfortable operating in ambiguity.
• Bachelor's degree or above in IT, Cybersecurity, Business Administration, Engineering, or a related field.
• CISM, CRISC, or ISO 27001 credentials are a plus; experience in fintech or regulated industries is preferred.

Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution.

We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance.

Our Commitment

Payward celebrates diverse talents and backgrounds. We hire based on merit and encourage applications even if you don't meet every listed requirement. We may use job-related skills or work-style assessments as part of our hiring process. As an equal opportunity employer, we do not tolerate discrimination or harassment.