• Experience building security data products at scale, ideally using SQL, dbt, Airflow, Airbyte, Snowflake
• Experience building metrics using data visualization tools, ideally using Apache Superset
• Experience writing code to build on and integrate with web application APIs, ideally using Python and REST APIs
• A strong bias toward evidence, logic, math, and reason when communicating risk (instead of fear, uncertainty, and doubt)
• A strong bias toward “guardrails, not gates” and “paved security roads” philosophies (instead of rigid “centralized command-and-control” processes and operating styles)
• Excellent ability to plan, prioritize, and deliver results cross-functionally and in a timely fashion
• Proficiency discussing complex, nuanced topics with technical & non-technical audiences alike, especially software engineers
• Strong alignment with Klaviyo’s core values

Desirable

• We’re seeking a highly collaborative Senior Security Risk Engineer who will help us continue to evolve our Risk function by using engineering principles and data-driven strategies to precisely identify, understand, communicate, and prioritize mitigation of risk
• This role will start out primarily focused on supporting our security metrics program, with a big focus on data engineering and making security metrics easily accessible and highly impactful for stakeholders
• You’ll partner closely with Engineering, IT, Security, Leadership, and basically every other team at Klaviyo to create a holistic view of risk based on high-quality data about our assets, weaknesses, threats, and safeguards (controls)
• You will help evolve our risk management practices to be transparent, evidence-based, and centered around quantitative risk models
• Through all of this, Klaviyo will be in a much better position to sustainably grow and deliver value to our customers
• Build and curate security metrics (KPIs, KRIs, KCIs) that provide actionable, real-time risk insights that answer meaningful business questions
• Automate and streamline third-party and internal security risk management processes
• Assist with risk management operations, including risk assessments and risk reviews
• Identify and assess risks using qualitative and quantitative methods, such as FAIR
• Co-create security standards and risk plans with InfoSec and partner team subject matter experts