Head of Security GRC

Role overview

A senior leadership role reporting to the CISO, owning the security governance, risk, and compliance program within a regulated broker-dealer and embedded fintech environment. The position acts as connective tissue across security, risk, and the executive team, translating deep technical and regulatory risk into business-aligned decisions. It is a builder role focused on maturing frameworks, quantifying enterprise risk, and standing up threat intelligence, incident-response readiness, and third-party due-diligence capabilities.

Responsibilities

• Lead and mature the enterprise GRC program, aligning controls with recognized frameworks such as NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS Controls
• Maintain the cybersecurity policy, standard, and procedure library, including annual review cycles, control ownership, exceptions, and waivers
• Operate the information security risk register, conducting risk assessments, defining treatment plans, and tracking residual risk over time
• Ensure compliance with SEC and FINRA obligations such as Regulation S-P (Safeguards & Disposal), Rule 17a-4 recordkeeping, and broader financial-industry security requirements
• Manage external and internal security audits and examinations including SOC 1, SOC 2 Type II, and ISO 27001, coordinating evidence collection and remediation tracking
• Establish control testing and continuous control monitoring, driving remediation of gaps to closure across control owners
• Support cyber threat intelligence, incident-response readiness, and third-party and client cyber due-diligence programs

Requirements

• Significant experience leading security GRC functions within a regulated broker-dealer or comparable financial-services environment
• Deep familiarity with NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS Controls
• Working knowledge of SEC, FINRA, and global data-protection regulations such as GDPR, CCPA/CPRA, LGPD, and GLBA
• Demonstrated ability to interface credibly with regulators, auditors, enterprise partners, and executive stakeholders
• Proven track record running risk registers, control testing, and policy lifecycle management
• Strong written and verbal communication skills, with the ability to translate technical risk into clear business decisions

Nice to have

• Experience building threat-intelligence or incident-response programs from earlier stages
• Background coordinating annual security due-diligence reviews with critical partners and vendors
• Comfort operating with autonomy and driving initiatives to completion with minimal supervision

Benefits and work setup

• Compensation package including base, bonus, equity, and 401(k) match, plus heavily subsidized benefits and perks
• Coverage that includes dental, vision, disability, and paid parental leave
• Wellness reimbursement, company-provided phone, and a personal development allowance
• Generous paid time off and observed holidays

Applicants must already hold legal authorization to work in the country where the role is located; visa sponsorship is not currently offered for this position.