Manager, Security Governance, Risk, and Compliance

We exist to wow our customers. We know we’re doing the right thing when we hear our customers say, “How did I ever live without Coupang?” Born out of an obsession to make shopping, eating, and living easier than ever, we are collectively disrupting the multi-billion-dollar commerce industry from the ground up and establishing an unparalleled reputation for being leading and reliable force in South Korean commerce.

We are proud to have the best of both worlds — a startup culture with the resources of a large global public company. This fuels us to continue our growth and launch new services at the speed we have been since our inception. We are all entrepreneurs surrounded by opportunities to drive new initiatives and innovations. At our core, we are bold and ambitious people that like to get our hands dirty and make a hands-on impact. At Coupang, you will see yourself, your colleagues, your team, and the company grow every day.

Our mission to build the future of commerce is real. We push the boundaries of what’s possible to solve problems and break traditional tradeoffs. Join Coupang now to create an epic experience in this always-on, high-tech, and hyper-connected world.

Role Overview

The Security GRC Manager will lead the evolution of Coupang’s cybersecurity risk management and control governance capabilities, with a focus on continuous risk visibility, data-driven risk oversight, and measurable risk reduction. This leader will establish scalable methodologies to identify, assess, prioritize, and monitor cybersecurity risks across Coupang’s complex technology environment, moving beyond periodic assessments toward continuous, evidence-based risk management.

Working closely with AI GRC, Control Assurance, Security Engineering, Security Architecture, and broader Engineering teams, the Security GRC Manager will help develop a unified enterprise risk management and control governance framework across AI and cybersecurity. The role will drive consistent risk methodologies, effective control governance, and clear accountability for risk treatment, enabling leadership to make informed decisions about the organization’s evolving risk posture.

What You Will Do

Enterprise Cybersecurity & AI Risk Management

End-to-End Risk Lifecycle: Drive scalable methodologies to identify, assess, prioritize, monitor, and escalate cybersecurity risks across high-scale technology environments.

Unified Cyber & AI Framework: Partner closely with AI GRC to maintain a unified risk taxonomy and governance framework, harmonizing global industry standards (e.g., NIST CSF, NIST AI RMF, ISO 27001, ISO 42001) with local and regional regulatory obligations.

Continuous, Data-Driven Visibility: Maintain an actionable enterprise risk register connecting inherent risks, control gaps, treatment plans, and residual exposure through automated data feeds.

Executive Metrics & Reporting: Establish Key Risk Indicators and management reporting to translate technical findings, assurance results, and emerging threats into actionable business risk insights.

Control Governance & Monitoring

Control Lifecycle & Standards: Establish and mature the cybersecurity control governance framework, defining control objectives, ownership expectations, and effectiveness criteria.

Assurance & Root-Cause Integration: Partner with Control Assurance to ingest testing trends and systemic control deficiencies into risk assessments without duplicating operational audit testing.

Harmonization & Traceability: Drive control framework harmonization across global regulatory requirements and internal standards to improve traceability and eliminate duplication.

Continuous Control Monitoring: Collaborate with Control Assurance to define priorities for automated control validation and real-time posture tracking.

Team Leadership & Stakeholder Accountability

Team Development: Lead, mentor, and scale a high-performing Security GRC team, setting strategic roadmaps, clear owner