At WHOOP, we're on a mission to unlock human performance. WHOOP empowers members to perform at a higher level through a deeper understanding of their bodies and daily lives.
We're hiring for two separate roles at the Manager and Senior Manager levels. Final leveling will be based on each candidate's experience, leadership scope, demonstrated impact, and interview performance.
WHOOP is seeking a strategic and execution-oriented Manager and Senior Manager of Governance, Risk, and Compliance to lead the day-to-day execution and support the ongoing operation and enhancement of the GRC program in a fast-paced, high-growth environment. These roles are responsible for both the design and hands-on execution of GRC initiatives, collaborating across Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk, and strengthen operational resilience.
RESPONSIBILITIES
Drive the development, implementation, and continuous evolution of the governance program, driving both strategy and hands-on execution to maintain alignment with ISO 27001, SOC 2, GDPR, and other applicable regulatory frameworks
Partner in the development, implementation, and ongoing management of scalable security control frameworks, policies, standards, and security awareness programs, third-party risk assessment, SDLC assessment, and risk program management, contributing directly while guiding the team’s work to strengthen organizational compliance
Support incident response activities by ensuring regulatory requirements, breach documentation, and post-incident reviews are completed and translated into actionable improvements across the risk and compliance program
Actively manage the enterprise risk register, driving risk prioritization, maintaining visibility across key risk domains, and delivering executive-level reporting
Spearhead enterprise risk reviews by driving GRC intake and request triage, personally overseeing complex assessments while prioritizing and delegating work across the team
Coach, mentor, and develop GRC analysts while balancing hands-on execution with effective delegation and team enablement as the program scales
Lead the third-party risk management lifecycle by conducting and overseeing vendor risk assessments and due diligence in partnership with Legal, IT, and Security
Own the operational intake and triage process for all GRC requests, including third-party vendor risk assessments, security questionnaires, SDLC risk reviews, and compliance inquiries, ensuring work is prioritized, assigned, and completed within established service levels
Develop and report operational metrics and KPIs, providing weekly dashboards and status updates on assessment volumes, turnaround times, backlog, SLA performance, and program health to the leadership
Evaluate, implement, and continuously improve GRC tools, processes, and metrics through hands-on execution and operational leadership to support program scale, transparency, and accountability
QUALIFICATIONS
8+ years of experience in GRC, or information security preferably in health tech, SaaS, or regulated environments, with ~4+ years managing GRC, compliance, audit or cybersecurity professionals
Deep understanding of regulations and standards including, but not limited to ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations applicable to regulated or sensitive health data, including HIPAA where relevant
Experience managing or mentoring compliance, audit, or GRC professionals
Demonstrated experience leading operational GRC programs, including workload prioritization, KPI reporting, and cross-functional coordination
Strong understanding of cybersecurity controls, cloud security concepts, third-party risk assurance, and regulatory compliance requirements
Proven ability to build scalable, process-driven programs in high-growth or rapidly evolving environments
Highly organized and detail-oriented, with strong project execution and prioritization skills across competing deadlines
Superior communication and interpersonal skills - written and verbal
Relevant certifications (CISA, CISSP, CRISC, CIPP/E, ISO Lead Auditor, HITRUST CCSFP, or similar) are strongly preferred
A minimum bachelor’s degree in any discipline. Computer science, cyber security and risk or technology degrees preferred.
Skills Required
- 8+ years of experience in GRC or information security
- 4+ years managing GRC, compliance, audit or cybersecurity professionals
- Deep understanding of ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and HIPAA
- Experience leading operational GRC programs including workload prioritization and KPI reporting
- Experience with third-party risk management and vendor risk assessments
- Strong understanding of cybersecurity controls and cloud security concepts
- Proven ability to build scalable, process-driven programs in high-growth environments
- Highly organized and detail-oriented with strong project execution and prioritization skills
- Superior written and verbal communication and interpersonal skills
- Bachelor's degree (minimum); computer science, cybersecurity, or risk degrees preferred
- Relevant certifications (CISA, CISSP, CRISC, CIPP/E, ISO Lead Auditor, HITRUST CCSFP)
What the Team is Saying
.jpg)
.jpg)
WHOOP Compensation & Benefits Highlights
-
Parental & Family Support — Paid parental leave is listed at 18 weeks with an additional 2‑week transition period, signaling strong support for new parents. This depth stands out relative to typical packages highlighted in the materials.
-
Wellbeing & Lifestyle Benefits — Medical, dental, and vision coverage are paired with a $500 annual wellness stipend, a free WHOOP membership plus one to gift, daily meals at the Boston HQ, and access to a gym and recovery tools. These health‑aligned perks reinforce a recovery‑first total rewards philosophy.
-
Equity Value & Accessibility — Roles are described as eligible for stock options alongside salary, indicating accessible ownership as part of total rewards. This equity component is consistently highlighted in company materials and third‑party summaries.
WHOOP Insights
Similar Jobs
What We Do
At WHOOP, we’re on a mission to unlock human performance. WHOOP empowers members to perform at a higher level through a deeper understanding of their bodies and daily lives. Our wearable device and performance optimization platform has been adopted by many of the world's greatest athletes and consumers alike.
Why Work With Us
At WHOOP, we’re focused on building an inclusive and equitable team with a strong sense of belonging for everyone—increasing representation in every way as our team grows. We believe that our differences are our source of strength—so much so it’s one of our core values.
Gallery
WHOOP Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
