Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

We are seeking a Principal Technical Risk Analyst to lead and mature Toast’s Technical Risk Program. This role will report to the Sr. Director of Technical Governance, Risk, & Compliance and is part of the Information Security Organization.  This is a high-impact, senior individual contributor role responsible for owning the end-to-end cyber risk management program, including risk identification, assessment, reporting, and integration into enterprise risk and leadership decision-making. This role is not about maintaining a process — it is about building, operationalizing, and leading a program that drives real business decisions and outcomes.

You will partner closely with:

• Enterprise Risk Management (ERM)
• Security Engineering, Infrastructure, and Product teams
• Technical Compliance and Governance teams
• Senior leadership and executive forums

You will play a key role in advancing and scaling our Technical Risk program, further strengthening our data-driven approach to risk management and enabling informed, timely decision-making across the business.

A day in the life (Responsibilities)

Own and Lead the Technical Risk Program

• Own the end-to-end cyber risk lifecycle: risk identification, assessment, prioritization, mitigation tracking, and reporting
• Establish and operationalize a scalable risk operating model (risk discovery → intake → assessment → reporting → monitoring)
• Ensure the program operates with a predictable cadence, clear ownership, and strong execution rigor
• Drive adoption of the program across Security, Product, Engineering, and Infrastructure teams

Lead Technical Risk Management Across the Lifecycle

• Lead the end-to-end technical risk management lifecycle through close partnership with cross-functional stakeholders
• Establish and scale risk discovery mechanisms, including:
• Stakeholder engagement across Engineering, Product, Infrastructure, and Security
• Inputs from audits, incidents, assessments, and external signals
• Ensure continuous identification and prioritization of emerging and high-impact risks
• Translate technical issues into clear, business-relevant risk narratives
• Act as a trusted partner and challenger, influencing stakeholders to drive timely risk mitigation and resolution

Drive Risk Program Maturity and Transformation

• Lead the evolution of the technical risk program to support scale, consistency, and improved visibility In partnership with ERM, operate within, suggest enhancements to, and manage the following:
• Risk taxonomy and classification models
• Risk assessment and prioritization frameworks
• Risk-to-control mapping (linking risks to the controls and a Common Controls Framework)
• Own and evolve the use of Optro (fka AuditBoard) RiskOversight as the system of record
• Improve data quality, reporting capabilities, and workflow scalability
• Operationalize the program within AuditBoard RiskOversight (Optro) as the system of record
• Build scalable processes that enable automation, reporting, and  AI use cases

Enable Risk Governance and Decision Making Through Risk Insights

• Develop and deliver clear, executive-ready risk reporting and dashboards
• Manage and lead the Technical Risk Subcommittee and related governance forums:
• Prepare committee materials to ensure meetings are structured, actionable, and decision-oriented
• Clearly articulate risks, impacts, and recommended actions
• Provide leadership with:
• Visibility into top risks, mitigation plan progress, and trends
• Clear trade-offs and prioritization inputs
• Partner with Enterprise Risk Management (ERM) to align on risk taxonomy, reporting, and governance

Communicate, report, and escalate upward to the Enterprise Risk and Compliance Committee (ERCC)


What you'll need to thrive (Requirements)

Core Experience

• 8–12+ years of experience in Technical Risk, Security GRC, ERM, or related fields
• Proven experience owning and leading a technical/cyber risk program
• Strong understanding of:
• Cybersecurity domains (cloud, infrastructure, IAM, application security)
• Risk frameworks (NIST CSF, ISO 27001, etc.)
• Experience operating in high-growth, complex, cloud-based environments

Program Leadership & Execution

• Demonstrated ability to:
• Build and operationalize programs from 0 → 1 and 1 → scale
• Drive predictable execution cadence and rigor
• Translate ambiguity into structured, executable plans
• Strong program management discipline (planning, tracking, follow-through)

Risk & Analytical Thinking

• Ability to:
• Translate technical issues into clear risk narratives and business impact
• Prioritize risks based on impact and likelihood
• Drive data-informed decision-making

Communication & Influence

• Exceptional communication skills:
• Executive-ready written and verbal communication
• Ability to structure updates: What / So What / Now What / Decision Needed
• Proven ability to influence:
• Senior stakeholders
• Cross-functional teams without direct authority

Tooling & Systems

• Experience with GRC tools such as:
• Optro (fka AuditBoard-preferred), ServiceNow GRC, Workiva, etc.
• Ability to:
• Drive tool adoption and configuration
• Translate business processes into scalable system workflows

Special Sauce or Bonus Ingredients (Nice-to-Haves)

• Experience integrating technical risk into ERM programs
• Experience building risk dashboards, metrics, and reporting frameworks
• Familiarity with automation, AI, or data-driven GRC approaches
• Relevant certifications (CISSP, CISM, CISA, CRISC)

AI at Toast

At Toast, one of our company values is that we're hungry to build and learn. We believe learning new AI tools empowers us to build for our customers faster, more independently, and with higher quality. We provide these tools across all disciplines, from Engineering and Product to Sales and Support, and are inspired by how our Toasters are already driving real value with them. The people who thrive here are those who embrace changes that let us build more for our customers; it’s a core part of our culture.

Our Total Rewards Philosophy 
We strive to provide competitive compensation and benefits programs that help to attract, retain, and motivate the best and brightest people in our industry. Our total rewards package goes beyond great earnings potential and provides the means to a healthy lifestyle with the flexibility to meet Toasters’ changing needs. Learn more about our benefits at https://careers.toasttab.com/toast-benefits.

#LI-Remote

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

We are seeking a Principal Technical Risk Analyst to lead and mature Toast’s Technical Risk Program. This role will report to the Sr. Director of Technical Governance, Risk, & Compliance and is part of the Information Security Organization.  This is a high-impact, senior individual contributor role responsible for owning the end-to-end cyber risk management program, including risk identification, assessment, reporting, and integration into enterprise risk and leadership decision-making. This role is not about maintaining a process — it is about building, operationalizing, and leading a program that drives real business decisions and outcomes.

You will partner closely with:

• Enterprise Risk Management (ERM)
• Security Engineering, Infrastructure, and Product teams
• Technical Compliance and Governance teams
• Senior leadership and executive forums

You will play a key role in advancing and scaling our Technical Risk program, further strengthening our data-driven approach to risk management and enabling informed, timely decision-making across the business.

A day in the life (Responsibilities)

Own and Lead the Technical Risk Program

• Own the end-to-end cyber risk lifecycle: risk identification, assessment, prioritization, mitigation tracking, and reporting
• Establish and operationalize a scalable risk operating model (risk discovery → intake → assessment → reporting → monitoring)
• Ensure the program operates with a predictable cadence, clear ownership, and strong execution rigor
• Drive adoption of the program across Security, Product, Engineering, and Infrastructure teams

Lead Technical Risk Management Across the Lifecycle

• Lead the end-to-end technical risk management lifecycle through close partnership with cross-functional stakeholders
• Establish and scale risk discovery mechanisms, including:
• Stakeholder engagement across Engineering, Product, Infrastructure, and Security
• Inputs from audits, incidents, assessments, and external signals
• Ensure continuous identification and prioritization of emerging and high-impact risks
• Translate technical issues into clear, business-relevant risk narratives
• Act as a trusted partner and challenger, influencing stakeholders to drive timely risk mitigation and resolution

Drive Risk Program Maturity and Transformation

• Lead the evolution of the technical risk program to support scale, consistency, and improved visibility In partnership with ERM, operate within, suggest enhancements to, and manage the following:
• Risk taxonomy and classification models
• Risk assessment and prioritization frameworks
• Risk-to-control mapping (linking risks to the controls and a Common Controls Framework)
• Own and evolve the use of Optro (fka AuditBoard) RiskOversight as the system of record
• Improve data quality, reporting capabilities, and workflow scalability
• Operationalize the program within AuditBoard RiskOversight (Optro) as the system of record
• Build scalable processes that enable automation, reporting, and  AI use cases

Enable Risk Governance and Decision Making Through Risk Insights

• Develop and deliver clear, executive-ready risk reporting and dashboards
• Manage and lead the Technical Risk Subcommittee and related governance forums:
• Prepare committee materials to ensure meetings are structured, actionable, and decision-oriented
• Clearly articulate risks, impacts, and recommended actions
• Provide leadership with:
• Visibility into top risks, mitigation plan progress, and trends
• Clear trade-offs and prioritization inputs
• Partner with Enterprise Risk Management (ERM) to align on risk taxonomy, reporting, and governance

Communicate, report, and escalate upward to the Enterprise Risk and Compliance Committee (ERCC)


What you'll need to thrive (Requirements)

Core Experience

• 8–12+ years of experience in Technical Risk, Security GRC, ERM, or related fields
• Proven experience owning and leading a technical/cyber risk program
• Strong understanding of:
• Cybersecurity domains (cloud, infrastructure, IAM, application security)
• Risk frameworks (NIST CSF, ISO 27001, etc.)
• Experience operating in high-growth, complex, cloud-based environments

Program Leadership & Execution

• Demonstrated ability to:
• Build and operationalize programs from 0 → 1 and 1 → scale
• Drive predictable execution cadence and rigor
• Translate ambiguity into structured, executable plans
• Strong program management discipline (planning, tracking, follow-through)

Risk & Analytical Thinking

• Ability to:
• Translate technical issues into clear risk narratives and business impact
• Prioritize risks based on impact and likelihood
• Drive data-informed decision-making

Communication & Influence

• Exceptional communication skills:
• Executive-ready written and verbal communication
• Ability to structure updates: What / So What / Now What / Decision Needed
• Proven ability to influence:
• Senior stakeholders
• Cross-functional teams without direct authority

Tooling & Systems

• Experience with GRC tools such as:
• Optro (fka AuditBoard-preferred), ServiceNow GRC, Workiva, etc.
• Ability to:
• Drive tool adoption and configuration
• Translate business processes into scalable system workflows

Special Sauce or Bonus Ingredients (Nice-to-Haves)

• Experience integrating technical risk into ERM programs
• Experience building risk dashboards, metrics, and reporting frameworks
• Familiarity with automation, AI, or data-driven GRC approaches
• Relevant certifications (CISSP, CISM, CISA, CRISC)

AI at Toast

At Toast, one of our company values is that we're hungry to build and learn. We believe learning new AI tools empowers us to build for our customers faster, more independently, and with higher quality. We provide these tools across all disciplines, from Engineering and Product to Sales and Support, and are inspired by how our Toasters are already driving real value with them. The people who thrive here are those who embrace changes that let us build more for our customers; it’s a core part of our culture.

Our Total Rewards Philosophy 
We strive to provide competitive compensation and benefits programs that help to attract, retain, and motivate the best and brightest people in our industry. Our total rewards package goes beyond great earnings potential and provides the means to a healthy lifestyle with the flexibility to meet Toasters’ changing needs. Learn more about our benefits at https://careers.toasttab.com/toast-benefits.

#LI-Remote

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

The Lead Technical Governance Analyst is a high-impact, autonomous role responsible for designing and driving the foundational architecture of our world-class GRC program. 

A day in the life (Responsibilities) 

In this role, you will play an integral part in building the frameworks, systems, and transformation programs that enable scale and efficiency across all security and compliance and risk domains. In addition, you will be responsible for supporting the ongoing oversight of certain workforce-related security initiatives and policies, and will collaborate closely with our Security and Business Technology and Transformation teams to ensure the security of Toast’s sensitive data and critical infrastructure. This role requires a proactive and strategic approach to identifying and mitigating risks, as well as a deep understanding of the evolving cybersecurity landscape.

• Drive Security and Technical Governance Risk and Compliance Initiatives:
• GRC Platform Ownership: Serve as the primary admin and product owner for the GRC platform (AuditBoard). You will move beyond administration to design advanced workflows, automation, and metrics that centralize risk and compliance data.
• Common Controls Framework (CCF) Stewardship: Own and evolve the Common Controls Framework. You will map and maintain complex regulations (NIST CSF, SOC 2, PCI DSS, ISO 27001) to a single source of truth, directly driving compliance efficiencies
• Lead Strategic Initiatives: Independently lead complex, cross-functional "zero-to-one" security programs, taking them from concept to operational maturity.
• Customer Trust Optimization: Drive the strategy for our Trust Center, operationalizing our ability to address customer and partner security questionnaires in a more efficient manner,reducing manual efforts and shortening lead times.
• Develop and implement governance policies, controls, and best practices to enhance the security posture across corporate IT and workforce systems. 
• "Compliance by Design" Advisory: Champion the "Shift Left" strategy by co-developing standards that embed GRC checkpoints into the SDLC and Product innovation pipelines, ensuring security is baked in, not bolted on.
• Change Events Governance: Define and standardize the process for assessing GRC impacts during major system changes, ensuring consistent intake and triage across all compliance programs.
• Track and report on security governance KPIs and risk metrics, driving continuous improvement. 

• Collaborate with IT and Security:
• Partner closely with the IT team to ensure corporate systems are managed appropriately and meet security objectives. 
• Work with the Security team to implement monitoring and detection capabilities that support workforce security objectives. 
• Promote Security Culture:
• Foster a strong security culture within the organization through training, awareness programs, and ongoing communication. . 

What you'll need to thrive (Requirements)

Core Program & Technical Experience

• 8+ Years of progressive experience in Information Security GRC, Audit, or Technical Program Management. 
• CCF & Framework Expertise: Hands-on experience designing and operationalizing a Common Controls Framework (CCF) to map and consolidate controls across multiple regulatory frameworks (SOX, PCI DSS, SOC 2, NIST CSF, ISO 27001).
• GRC Platform Mastery: Proven experience serving as an Administrator, Architect, or primary owner of a modern GRC tool (e.g., AuditBoard, ServiceNow GRC, Workiva), including advanced workflow design, configuration, and maintenance.
• Policy Architecture: Expert ability to define, manage, and enforce a clear hierarchy of governance documentation (Policy, Standard, Procedure) and maintain security baselines for corporate IT and workforce tools.
• Program Ownership: Demonstrated ability to drive the lifecycle of complex security initiatives, such as Data Governance Oversight, SaaS Posture Management, End Protection/Hardware Inventory, and Third-Party Risk Management.
• Technical Acumen: Strong understanding of cybersecurity controls across cloud security, corporate IT security, and identity and access management (IAM). Committed to staying ahead of the curve in the ever-evolving field of cybersecurity.

Leadership & Collaboration

• Proven ability to lead and manage security initiatives and drive complex, cross-functional collaboration efforts without direct authority.
• Builds strong relationships with stakeholders across the organization and thrives in a dynamic and rapidly changing environment. 
• Exceptional written and verbal communication skills, with the ability to translate complex security architecture into clear business risks for non-technical audiences.
• A proactive and strategic approach to identifying, mitigating, and documenting risks in a high-growth, fast-paced technology environment.

Special Sauce (Nice-to-Haves)

• Controls Engineering Experience: Experience with scripting (e.g., Python, SQL) or building APIs/integrations to automate evidence collection.
• Advanced Certifications: Relevant security certifications such as CISSP, CISM, or CISA.
• Teaching/Enablement: Experience designing or facilitating training programs (e.g., Compliance Champions) or leading Cyber Tabletop Exercises.
• Experience supporting security governance in a remote or hybrid workforce environment.

AI at Toast

At Toast, one of our company values is that we're hungry to build and learn. We believe learning new AI tools empowers us to build for our customers faster, more independently, and with higher quality. We provide these tools across all disciplines, from Engineering and Product to Sales and Support, and are inspired by how our Toasters are already driving real value with them. The people who thrive here are those who embrace changes that let us build more for our customers; it’s a core part of our culture.

Our Total Rewards Philosophy 
We strive to provide competitive compensation and benefits programs that help to attract, retain, and motivate the best and brightest people in our industry. Our total rewards package goes beyond great earnings potential and provides the means to a healthy lifestyle with the flexibility to meet Toasters’ changing needs. Learn more about our benefits at https://careers.toasttab.com/toast-benefits.

#LI-Remote