Senior Manager: Governance, Risk Compliance; GRC)

At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers

members to perform at a higher level through a deeper understanding of their bodies

and daily lives.

As a Senior Manager GRC you will play a critical role in shaping, driving, and leading

our GRC team towards supporting ongoing operation and enhancement of the overall

information security governance program, assessing the risk landscape in a fast-paced,

high-growth environment. This role will strategically craft the roadmap in collaboration

with stakeholders across the business and fulfill growing security needs assessing risk

landscape across WHOOP.

In addition to core GRC responsibilities, you will partner closely with functions across

Product, Engineering, Data Analytics, and Legal to meaningfully move the security

posture of the company. We are seeking a leader and strategic partner with prior

experience driving GRC programs for technology teams.

• Lead the development, implementation, and continuous evolution of the GRC

  program, driving both strategy and hands-on execution.

• Lead the development, implementation, and ongoing management of scalable

  security control frameworks, policies, standards, and security awareness

  programs, contributing directly while guiding the team’s work to strengthen organizational compliance.

• Support incident response activities and translated into actionable improvements

  across the risk and compliance program.

• Actively manage the enterprise risk register, driving risk prioritization, and

  delivering executive-level reporting.

• Manage, mentor, and develop GRC analysts while balancing hands‑on execution

  with effective delegation and team enablement as the program scales.

• Evaluate, implement, and continuously improve GRC program, tools, processes,

  and metrics.

• 10+ years of experience in GRC, or information security / cybersecurity, with 5+

  years in managing GRC, information security, or cybersecurity professionals.

• Demonstrated success scaling GRC programs whilst crafting clear and efficient

  team objectives and programs.

• Deep understanding of regulations and standards including, but not limited to ISO

  27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations

• Experience building or integrating GRC programs in enterprise security to

  improve overall security posture of the organization

• Excellent communication, interpersonal, and leadership skills with the ability to

  influence across teams and levels

• A minimum bachelor’s degree in any discipline. Computer science, cyber security

  and risk or technology degrees preferred.

• Certifications such as CISA, CISSP, CIPP/E, CRISC, or ISO Lead Auditor.

• Background in leading Enterprise Risk, Cybersecurity Risk, Information Security

  programs.

• Background in establishing Dev Sec Ops , AI Governance, and SSDLC guardrails.

• You are a strategic and people-focused leader who thrives on balancing hands‑on

  oversight with long‑term organizational growth.

• You are a risk aware leader with ability to translate security risks in business

  terms to influence both technical and non-technical teams.

• You are passionate about building bridges across different departments and can

  operate confidently in both strategic and security control tactical domains.

• You believe that security enables innovation, and you lead with integrity fostering

  a culture that embodies a risk mind-set.

This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.

WHOOP is an Equal Opportunity Employer and participates in E-verify to determine employment eligibility

The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent…