Senior GRC Program Manager

THE WORK:

As a Senior GRC Program Manager, you will be a critical presence in Ripple's Luxembourg entity, strengthening local governance and operational execution as Ripple scales its regulated activities across Europe. This role sits at the intersection of ICT operations, security, and regulatory compliance in the digital asset space — bridging Ripple's global engineering teams with the on-the-ground requirements of one of the most demanding environments in financial services.

WHAT YOU’LL DO:

• Ensure the operational implementation and maintenance of EU / Luxembourg security frameworks, including the Digital Operational Resilience Act (DORA) and supporting technical standards.


• Own the day-to-day management and operational oversight of outsourced ICT and security services (provided by related entities within the Ripple Group or third parties), ensuring service delivery meets local regulatory standards and SLAs.


• Effectively engage with global Engineering and IT teams to track and evaluate future infrastructure, application, and architectural changes, ensuring they are designed with operational resilience and regional compliance in mind.


• Coordinate the implementation of technical security controls across our infrastructure and application environments, ensuring alignment with Ripple’s internal controls and regulatory guidelines (e.g., EBA, ESMA, CSSF).


• Collaborate with global InfoSec teams to develop, maintain, and localize InfoSec Policies, Standards, and Procedures relevant to EU compliance.


• Directly access systems to pull technical evidence, such as logs, system settings, and access reports, to support continuous operational monitoring, incident response, and compliance efforts.


• Act as the operational domain expert during internal audits, customer audits, and regulatory exams by providing necessary technical evidence and demonstrating a strong working knowledge of our infrastructure and security processes.


• Partner with our global Engineering, Compliance, Finance, Product, Legal, and Sales teams to provide operational security guidance and have a direct impact on Ripple’s product security and customer trust.


• Support regional customer-facing activities by assisting in responding to security due diligence questionnaires and reviewing technical aspects of customer contracts.


• Attend and participate in local and regional industry events and discussions to stay current on evolving regulations, threats, and best practices.

WHAT YOU'LL BRING: 

• 5+ years of experience in Information Security infrastructure, preferably within a highly regulated industry.


• Demonstrable experience working within the Luxembourg financial or technology sector, with a strong understanding of the local business and regulatory landscape.


• Solid working knowledge of DORA operational requirements, including resilience testing, ICT third-party management, and incident response.


• Familiarity with EU regulatory frameworks, including MiCA and related EBA and ESMA technical standards.


• Proficiency with common information technology and security frameworks, such as ISO 27001, SOC2, and NIST.


• Comfortable accessing systems directly to gather and analyse technical evidence, including logs, configuration data, and database queries, within a cloud-native environment.


• Ability to create clear, audience-tailored technical documentation and SOPs.


• Experience collaborating effectively with cross-functional teams of engineers, product managers, and compliance experts.


• Familiarity with tools such as Jira, Confluence, JupiterOne, Okta, AWS, Tines, and integrated GRC platforms is an advantage.


• Desirable certifications include CISSP, CISA, AWS Certified Security, and PMP.


• Professional proficiency in French is desirable; proficiency in English is required.