Governance Risk & Compliance Manager

Join WHOOP, a fast-paced, high-growth company, as a Governance Risk & Compliance Manager. In this role, you will lead the day-to-day execution of the GRC program, collaborating with various teams to advance compliance objectives and reduce enterprise risk exposure. You will manage team workload, develop operational metrics, contribute to governance activities, maintain the enterprise risk register, and support security incident response activities. Enjoy a flexible vacation policy, paid parental leave, stock options, complimentary WHOOP membership, and a competitive benefits package.

• Lead the day-to-day operations of the Governance, Risk, and Compliance (GRC) function, ensuring timely execution of governance, risk, compliance, third-party risk, and secure development lifecycle assessment activities.
• Collaborate across Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk exposure, and strengthen operational resilience.
• Manage team workload and capacity by assigning, tracking, and escalating requests as needed to ensure consistent delivery, quality, and stakeholder satisfaction.

• You are passionate about building scalable GRC programs that have a lasting impact in improving the overall security posture of an organization without slowing the speed of innovation
• You have the ability to assess a risk impact in terms of business trade-offs
• You are a risk focused GRC leader with ability to assess security risks and translate it into business impact
• Strong knowledge of SSDLC risk assessments and application security governance processes
• Excellent written and verbal communication skills, with the ability to communicate effectively with technical teams, business stakeholders, auditors, and executive leadership
• Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience
• The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office
• A minimum bachelor’s degree in any discipline. Computer science, cybersecurity, and risk or technology degrees preferred
• Deep knowledge of security and privacy frameworks and regulations, including ISO 27001, SOC 2, NIST CSF, HIPAA, GDPR, PCI DSS, and modern cybersecurity risk management practices
• Demonstrated experience leading operational GRC programs, including intake management, workload prioritization, KPI reporting, and cross-functional coordination
• Extensive hands-on experience performing third-party/vendor risk assessments, security reviews, due diligence, and risk-based decision support
• 8+ years of experience in GRC, information security, cybersecurity; with 2+ years of experience leading or managing GRC, information security, or audit professionals
• Professional certifications such as CISSP, CRISC, CISA, ISO 27001 Lead Auditor, or HITRUST CCSFP
• Exceptional organizational, analytical, and problem-solving skills
• Demonstrated success in program and project management skills with the ability to manage multiple concurrent workstreams in a fast-paced environment
• Background in establishing SSDLC guardrails