Head of Security GRC
$270k - $290k+ Bonus + Equity + 401(k) match
Expert
Seattle, WA, USA+7 moreMore locations: San Francisco, CA, USA | Austin, TX, USA | Miami, FL, USA | Dallas, TX, USA | Chicago, IL, USA | New York, NY, USA | Denver, CO, USA
HybridNew York City and Chicago candidates must come into the office on a cadence set by the hiring manager/team. Remote candidates may need occasional onsite visits; applicants must be based in a listed location.
CybersecuritySecurity Governance, Risk & Compliance
No H1B Sponsorship
About the job
Requirements
- At least 15 years of experience in information security, risk management, or cybersecurity roles, including significant experience in a regulated financial-services environment and prior ownership of a GRC function.
- Strong practical understanding of SEC/FINRA regulations applicable to broker-dealers, including Regulation S-P, Rule 17a-4, and cyber disclosure obligations.
- Expertise in global data-protection laws, including GDPR, CCPA/CPRA, and LGPD, and their operational impact.
- Hands-on experience leading GRC programs and risk-management initiatives end to end.
- Demonstrated ownership of SOC 1, SOC 2, and ISO 27001 examinations and compliance audits.
- Experience building security KPIs/KRIs and executive- or board-level reporting.
- Working knowledge of threat intelligence, incident-response planning, and runbook development.
- Proven third-party risk management and client/partner security due diligence.
- Ability to work independently and drive initiatives to completion.
- Must be authorized to work for any employer in the United States without current or future visa sponsorship.
- Must be based in one of the listed locations: New York City, Chicago, Austin, Dallas, Denver, Miami, San Francisco Bay Area, or Seattle.
Responsibilities
- Own and mature the enterprise GRC program, aligning controls to NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS Controls.
- Maintain and organize the cybersecurity policy, standard, and procedure library; run the annual review cycle; and manage control ownership, exceptions, and waivers.
- Operate the information security risk register by conducting risk assessments, defining treatment plans, facilitating risk-acceptance workflows, and tracking residual risk over time.
- Ensure compliance with SEC/FINRA requirements, including Regulation S-P, Rule 17a-4 recordkeeping, and financial-industry security obligations.
- Manage external and internal security audits and examinations, including SOC 1, SOC 2 Type II, and ISO 27001; coordinate auditors and evidence collection; and track remediation.
- Establish and run control testing and continuous control monitoring, driving remediation of gaps to closure across control owners.
- Establish procedures for annual security due-diligence reviews with critical partners and vendors.
- Maintain and enforce compliance with global data-protection laws, including GDPR, CCPA/CPRA, LGPD, and GLBA.
- Interpret and operationalize evolving SEC cybersecurity risk-management and incident-disclosure obligations relevant to registrants and broker-dealers.
- Assess and manage the applicability of NYDFS 500, PCI DSS, and state breach-notification requirements to the platform's control environment.
- Serve as a subject-matter expert for security compliance, providing guidance to business units, product, and engineering.
- Partner with Legal, Privacy, and Compliance teams to ensure end-to-end regulatory adherence.
- Design and maintain a security metrics, KPI, and KRI framework measuring control effectiveness, risk posture, and program maturity.
- Build and deliver executive dashboards and board-level reporting, translating technical risk into clear business and financial impact for the CISO, audit committee, and board.
- Track and report remediation SLAs, risk trends, control-maturity progression, and audit-finding closure.
- Produce reporting packages supporting regulatory exams, partner assurance, and internal governance committees.
- Refine metrics so leadership can make risk-informed investment and prioritization decisions.
- Stand up and operate a cyber threat-intelligence capability tailored to financial services, broker-dealers, and embedded-finance ecosystems.
- Track relevant threat actors, campaigns, and TTPs using frameworks such as MITRE ATT&CK, and leverage sector sources including FS-ISAC.
- Produce strategic, operational, and tactical threat reporting for technical teams and executive stakeholders.
- Integrate intelligence into risk assessments, control decisions, and incident-response readiness, ensuring emerging threats drive prioritized action.
- Monitor for threats to partners and the broader supply chain that could create downstream client or platform risk.
- Own, maintain, and regularly test the Incident Response Plan, ensuring it reflects the current threat landscape and regulatory obligations.
- Develop and maintain incident runbooks/playbooks for high-priority scenarios, including ransomware, business email compromise, account takeover, data exposure, and third-party or partner breach.
- Plan and facilitate tabletop exercises across security, engineering, legal, compliance, and executive leadership.
- Map response procedures to regulatory and contractual notification requirements, including SEC incident disclosure, Regulation S-P breach notification, state laws, and partner SLAs.
- Lead post-incident reviews and lessons learned, translating findings into control and process improvements.
- Own the end-to-end vendor risk lifecycle, including intake, risk tiering, security due diligence, contractual security terms, ongoing monitoring, and secure offboarding.
- Partner with Legal, Procurement, IT, and Compliance on the TPRA process and security controls embedded in vendor evaluations.
- Assess concentration, fourth-party, and SaaS supply-chain risk, escalating material exposures to the CISO.
- Maintain the vendor inventory and reassessment cadence, ensuring critical suppliers are reviewed on a defined schedule.
- Establish and enforce minimum security requirements for vendors handling regulated or sensitive data.
- Own responses to inbound security questionnaires, RFPs, and enterprise-client due-diligence requests, serving as the security subject-matter expert during partner evaluations.
- Build and maintain a reusable security trust package, including SOC 2 reports, penetration-test summaries, questionnaire libraries, and a security whitepaper, to accelerate sales and partnership cycles.
- Partner with Sales, Partnerships, and Legal to translate client security requirements into commitments the platform can meet and evidence.
- Establish standardized due-diligence procedures and scoring so client and partner assessments are consistent, repeatable, and defensible.
- Act as a key liaison between internal business units, regulators, and external partners on security matters.
- Communicate regular updates on security posture, risk, and compliance to senior leadership.
- Represent the company in regulatory discussions, industry panels, and security conferences as needed.
- Provide expert guidance on security frameworks, standards, and industry best practices, and mentor teammates on GRC practices.
Desired Qualifications
- Experience at a broker-dealer, fintech, or embedded-finance/brokerage-as-a-service organization.
- Exposure to multi-jurisdictional or cross-border regulatory and privacy environments.
- Familiarity with MITRE ATT&CK, FS-ISAC, and financial-sector threat landscapes.
- Hands-on experience with GRC/IRM and TPRM platforms and reporting/BI tooling.
- CISM, CISSP, CRISC, CISA, or ISO 27001 Lead Auditor certification.
About the company
DriveWealth provides a global Brokerage-as-a-Service (BaaS) fintech platform that lets banks, broker dealers, asset managers, digital wallets, and consumer brands add investing and trading to their offerings. It does this through APIs that partners integrate into their own products, providing a modern toolkit to support traditional investment workflows and newer ideas like rounding up purchases into fractional-share ownership. Compared with competitors, DriveWealth differentiates itself by its broad B2B focus and extensible API platform that enables a wide range of partner integrations, from traditional investment processes to micro-investing features, all under a scalable, partner-first model. The company's goal is to help partners embed investing experiences into their services and generate revenue by charging fees for access to its platform and services.
Company Size
201-500
Company Stage
Series D
Total Funding
$552.8M
Headquarters
New York City, New York
Founded
2012
Get referred to DriveWealth
See people who can refer or advise you
Simplify's Take
What believers are saying
- DriveWealth launched Ualá U.S. stock investing in Mexico on March 10, 2026.
- It keeps winning new partner launches across Latin America and private banking.
- No unauthorized trades, transfers, withdrawals, or client-platform outages followed the breach.
What critics are saying
- September 4-5, 2026 breach exposed Revolut, Stake, and Hatch customer data.
- Social-engineering access inside DriveWealth shattered trust in its brokerage rail model.
- Regulators and partners can reprice contracts or exit after repeated breach headlines.
What makes DriveWealth unique
- DriveWealth powers embedded brokerage APIs for banks, wallets, and consumer brands worldwide.
- Its 2026 Kalshi partnership extends brokerage infrastructure into regulated prediction markets.
- IOL Privé launch on August 14, 2026 shows premium cross-border wealth distribution.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Insurance – Medical, Dental, Vision, Life, LTD & STD. HSA and FSA options.
- Unlimited PTO
- 401k plan
- Flexible working hours and work from home
- Continuing education and conferences reimbursement
- Fitness/Wellbeing reimbursement
- Home Office stipend
- Lunch program, snacks and beverages available in the office