Staff Security GRC Engineer / Manager
Ripple Labs, Inc. · San Francisco, CA
- Automated User Access Reviews (UARs) for compliance audits across 100% of in-scope apps, integrating Workday and 120+ system reports via Tines to cut review cycles from 2+ months to one.
- Integrated Claude (AWS Bedrock) into UARs to flag terminated users against Workday records, analyze access lists for non-integrated apps, and perform AI-powered final checks after human reviews, reducing manual effort and improving SLAs.
- Built the Third-Party Security Evaluation (TPSE) module in LogicGate, using Tines to orchestrate ETL jobs between LogicGate, ZIP, BitSight, and Oracle Finance Procure-to-Pay, automating 300+ monthly notifications and 20 assessments/month, saving $80K annually.
- Integrated Claude (AWS Bedrock) into TPSE to auto-review pen test and compliance reports, summarize findings, and auto-approve low-risk vendors by evaluating ISO 27001, SOC 2, and InfoSec policy documents.
- Built Ripple's first security maturity scorecard, consolidating 1,500+ controls across NIST, SOC 2, ISO 27001, CIS, and NYDFS into 300 Ripple Universal Controls, serving as a board-level reporting artifact for 3+ years.
- Delivered 300+ automated evidence pipelines by establishing programmatic API access across 20+ systems (Okta, Workday, AWS, GCP, Azure, GitLab, Salesforce, and others), automating 60% of SOC 2 records and saving 57 hours per audit cycle. Integrated Gemini AI to guarantee source system integrity by generating API call logs and payload output at execution.
- Deployed AI-driven controls testing using Claude and Gemini, achieving 34.3% automated coverage across 49 control tests and 530 regulatory requirements, surfacing overprivileged Vault policies, GitLab groups, and LDAP misconfigurations.
- Founding member of Ripple's AI Strike Team, defining and operationalizing the AI Software Risk Methodology.
- Extended automation to Learning & Development (98% on-time training), Finance Operations (5 hrs/week saved), Privacy Data Inventory, and Partner Onboarding.