Security Risk Governance Analyst

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. Must not include Job ID etc. Must preserve all substantive info. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. We need to parse the posting. Content: - About The Role: paragraph describing role. - Then "The base salary offered for this role and level of experience will begin at $105,000.00 and up to $145,000.00. Full-time employees are also eligible for a bonus, competitive equity package, and benefits. The actual base salary offered may be higher, depending on your location, skills, qualifications, and experience." That's Pay and Benefits. - Then "In this role, you can expect to" list of duties. - Then "To thrive in this role, you have" list of requirements. - Then "Progress toward a security or audit certification such as CISA, CRISC, or Security+ is a plus. We support analysts in earning them." (maybe part of qualifications/skills) - Then "Experience working with AWS, GitHub, and/or GCP is a plus." - Then "A Little About Us" (company description) - maybe not needed? It's about company; could be part of About the role? But we have About the role already. The "A Little About Us" is company overview; we could include as part of About the role? But rule: include section only when posting has real specific content for it. The "A Little About Us" is not a standard heading; but we could treat as part of About the role? However we already have About the role section. Could we add a separate "About Chime" section? Not in allowed headings list. The allowed headings are: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should map content accordingly. Thus: - About the role: first paragraph about role. - Responsibilities: list of duties (the "In this role, you can expect to" bullet list). Also maybe some other duties like "Help define and maintain security KPIs..." etc. All those are responsibilities. - Requirements: maybe the "To thrive in this role, you have 2–4 years of experience..." list. - Qualifications: maybe certifications etc? Could combine with Requirements? But we need to decide. - Skills: maybe specific technical skills: vulnerability management tooling, frameworks, AWS/GitHub/GCP, etc. - Benefits: list of benefits from "What We Offer For Our Full-time, Regular Employees" (but we must remove boilerplate like EEO etc). Benefits include: in-office work policy, backup child/elder/pet care, subsidized commuter benefits, comprehensive health/financial/wellbeing benefits, generous vacation policy and company-wide paid days off, 1% of time off to support local community orgs, annual wellness stipend, up to 22 weeks paid parental leave for birthing parents and 12 weeks for non-birthing, access to family planning reimbursement, challenging opportunity etc. Also "bonus, competitive equity package, and benefits" earlier. - Pay: salary range. - Schedule: maybe mention in-office work policy: four days a week in office and Fridays from home for those near one of our offices, plus team and company-wide events depending on location. Also fully remote program. That's schedule. Thus we need sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not include headings with filler. Ensure each has content. Now extract specifics. About the role paragraph: "We’re hiring a Security Risk Governance Analyst to help strengthen how Chime identifies, assesses, and manages security risk across our third-party ecosystem and internal control environment. You’ll work across vendor security reviews, risk assessments, controls testing, and key compliance initiatives, while helping turn security requirements into clear, repeatable processes. You’ll partner closely with teams across Security, Risk, Compliance, Engineering, Application Security, and Infrastructure Security to identify gaps, manage risk, and move assessments through to completion. You'll work alongside Senior Analysts who hold risk coverage for Chime's business domains, taking secondary coverage for one of them as you build depth. This role is a strong fit for someone building a security risk career who is organized, curious, and follows an assessment through to a documented decision." That's about the role. Responsibilities: list from "In this role, you can expect to:" plus maybe other duties like "Help define and maintain security KPIs, KRIs, and dashboards..." etc. Let's capture all bullet-like sentences after that. The text: "In this role, you can expect to Run third-party security reviews end to end: due diligence assessments, evidence collection, vendor interviews, and ongoing monitoring. Support SOX IT General Controls, PCI DSS, SOC 2, and ISO 27001 programs with audit preparation, evidence collection, and walkthrough coordination. Conduct risk assessments, gap analyses, and controls testing, including reviews of new tools, AI systems, and new lines of business arriving through Security intake. Record findings, remediation owners, and risk exceptions in the SRG risk register and track them to closure. Run quarterly user access reviews for applications in scope for SOX, SOC 2, PCI, and ISO 27001, including population builds in ConductorOne, reviewer follow-up, revocation and lookback handling, and evidence retention. Help define and maintain security KPIs, KRIs, and dashboards that give leadership clear visibility into risk and program performance. Develop or source security training content and support delivery to employees and contractors through a learning management system. Create and maintain operational runbooks, security baselines, and standards, and work with SRG engineering to move manual evidence collection into automated workflows. Move Security Architecture Reviews through the process with Security Engineering, Application Security, and Infrastructure Security, and help document the steps as they stabilize." We need to format as

• each. Requirements: "To thrive in this role, you have 2–4 years of experience in security, IT audit, risk, or compliance, or equivalent experience in a regulated environment. Hands-on experience with at least one of: third-party security reviews, risk assessments, or controls testing. Professional experience focused on information security, security risk, and/or security program management. Experience using vulnerability management tooling and managing security risk exceptions through their lifecycle. Working knowledge of security and compliance frameworks such as SOX, SOC 2, NIST 800-series or NIST Cybersecurity Framework, ISO 27001, and PCI DSS. Experience documenting security procedures, operational processes, standards, and runbooks. Evidence of driving work to closure through people you don't manage: chasing owners, unblocking, and escalating when it stalls. Comfort working without a fully defined path, and a habit of raising problems early with a proposed next step." That's requirements. Qualifications: maybe "Progress toward a security or audit certification such as CISA, CRISC, or Security+ is a plus. We support analysts in earning them." plus maybe "Experience working with AWS, GitHub, and/or GCP is a plus." Could be qualifications or skills. We'll decide: Qualifications: certifications plus maybe AWS/GitHub/GCP experience as plus. But we also have Skills section for technical skills. Let's assign: - Qualifications: certifications (CISA, CRISC, Security+) plus maybe AWS/GitHub/GCP experience as plus? But that's more skill. Better: Qualifications: certifications plus maybe "Experience working with AWS, GitHub, and/or GCP is a plus." Could be considered qualification. But we also have Skills: vulnerability management tooling, frameworks, documenting procedures, etc. However many of those are already in requirements. To avoid duplication, we can separate: Requirements: experience years and core experience. Skills: specific technical skills (vulnerability management tooling, frameworks, AWS/GitHub/GCP, documenting procedures, etc). Qualifications: certifications. Let's extract: Skills: - Experience using vulnerability management tooling and managing security risk exceptions through their lifecycle. - Working knowledge of security and compliance frameworks such as SOX, SOC 2, NIST 800-series or NIST Cybersecurity Framework, ISO 27001, and PCI DSS. - Experience documenting security procedures, operational processes, standards, and runbooks. - Experience working with AWS, GitHub, and/or GCP is a plus. Also maybe "Hands-on experience with at least one of: third-party security reviews, risk assessments, or controls testing." could be skill but it's in requirements. We'll keep that in requirements. Qualifications: - Progress toward a security or audit certification such as CISA, CRISC, or Security+ is a plus. We support analysts in earning them. Maybe also "Professional experience focused on information security, security risk, and/or security program management." but that's requirement. Ok. Benefits: from "What We Offer For Our Full-time, Regular Employees" plus earlier mention of bonus, competitive equity package, and benefits. Let's extract benefits list: - Bonus (eligible) - Competitive equity package - Benefits (general) - In-office work policy: four days a week in the office and Fridays from home for those near one of our offices, plus team and company-wide events depending on location. Also fully remote program. - Backup child, elder, and pet care - Subsidized commuter benefits for eligible employees - Comprehensive health, financial, and wellbeing benefits designed to support you at every stage of life - Generous vacation policy and company-wide paid days off - 1% of your time off to support local community organizations of your choice - Annual wellness stipend to use towards eligible wellness related expenses - Up to 22 weeks of paid parental leave for birthing parents and 12 weeks of paid parental leave for non-birthing parents - Access to family planning reimbursement - Challenging and fulfilling opportunity to join one of the most experienced teams in FinTech and help millions unlock financial progress (maybe not a benefit but we can include as part of benefits? It's more about role. Might be okay but it's not a benefit. Could skip.) We should not include boilerplate like EEO etc. The "We know that great work can’t be done without a diverse team..." is EEO/diversity statement; we should remove. Thus benefits section includes those items. Pay: salary range: base salary $105,000.00 to $145,000.00, plus bonus, equity, etc. Also mention actual base may be higher depending on location, skills, qualifications, experience. Schedule: in-office work policy: four days a week in office and Fridays from home for those near one of our offices, plus team and company-wide events depending on location. Also fully remote program. Now produce HTML. We must not include or . Just fragment. We'll produce:

  About the role

  ...

  Responsibilities

  • ...
  ...

  Requirements

  • ...
  ...

  Qualifications

  • ...
  ...

  Skills

  • ...
  ...

  Benefits

  • ...
  ...

  Pay

  ...

  Schedule

  ...

  Make sure to preserve all substantive info. No extra fluff. Check for duplication: Ensure we didn't miss any responsibilities like "Help define and maintain security KPIs..." etc included. Check that we didn't include any boilerplate like "We support analysts in earning them." That's fine. Now craft the HTML. Let's write the About