СШАDirector of Security & Risk
2 дн. назад
СШАDirectorRemote
Leadership role overseeing security and risk management to protect identities and prevent fraud.
Обязанности
- 's Information Security team is responsible for protecting our systems, data, and customers while enabling the business to operate securely and efficiently. We work closely with Engineering, IT, Legal, Product, and business teams to manage security risks, maintain regulatory compliance, and build effective security controls across the organization.
- We're looking for a Director of Security & Risk to lead our security governance, compliance, assurance, and risk management programs. This is a leadership role with broad ownership across FedRAMP, SOC 2, PCI DSS, customer and partner security assessments, third-party risk, and security policy.
- This is not a traditional GRC role. operates a highly technical, AWS-based environment, and many of the risks and compliance requirements we manage require deep technical understanding. We're looking for someone who can independently evaluate technical risks, understand security architecture and proposed remediations, and work effectively with engineers, auditors, regulators, and business stakeholders.
- You will lead and develop a team of security and compliance professionals, establish priorities, identify gaps in our existing programs, and develop a roadmap for improving our security posture. We expect you to bring the experience and judgment to identify problems and opportunities independently, rather than simply execute an existing plan.
- You will report to 's security leader and work closely with Security Engineering, which remains a separate function responsible for technical security architecture and implementation.
- Success in this role means building a proactive, effective, and scalable security program that goes beyond passing audits to meaningfully reducing organizational risk.
- This is a remote, US-based position.
- Lead and develop 's security governance, risk, and compliance organization. Manage and mentor security and compliance professionals, evaluate program effectiveness, identify gaps in expertise and capacity, and develop organizational and hiring plans as the company grows.
- Own 's security compliance and audit programs , including FedRAMP, SOC 2, and PCI DSS. Lead external assessments, manage control effectiveness and evidence collection, oversee Vanta and compliance automation, and ensure the organization continuously meets its obligations rather than preparing only for periodic audits.
- Drive the ongoing maturity of 's government security program. Oversee FedRAMP continuous monitoring, POA&M governance, change-management compliance, agency-specific requirements, and assessment readiness. Anticipate evolving requirements, including FedRAMP 20x, and develop plans to address them.
- Establish and operate a rigorous security risk management program. Own the identification, assessment, documentation, escalation, and treatment of security risks, control deficiencies, and exceptions. Ensure material risks receive appropriate attention and that remediation is tracked through completion.
- Lead 's third-party security risk management program. Establish and enforce risk-based vendor diligence requirements, improve assessment quality, manage ongoing vendor oversight, and ensure material security concerns are resolved or appropriately escalated before approval.
- Own customer and partner security assurance. Lead complex security assessments and audits from financial institutions, government agencies, and other partners. Evaluate contractual security requirements in collaboration with Legal, coordinate technical responses, and ensure security representations are accurate, complete, and defensible.
- Own security policy and control governance. Maintain security policies, standards, and control frameworks, ensuring requirements are appropriately mapped across regulatory obligations, reflected in actual operations, and periodically evaluated for effectiveness.
- Continuously improve the effectiveness and scalability of security programs. Develop clear accountability, measurable outcomes, repeatable processes, and automation. Proactively identify emerging risks and requirements, communicate recommendations to leadership, and drive improvements across organizational boundaries.
Требования
- 10+ years of experience in information security, including significant experience leading security governance, compliance, assurance, or risk management programs.
- Demonstrated experience owning major security compliance and assurance programs such as FedRAMP, SOC 2, PCI DSS, or comparable regulatory frameworks, including direct engagement with auditors, assessors, and external stakeholders.
- Strong technical understanding of modern cloud infrastructure, SaaS application security, identity and access management, vulnerability management, and security architecture. Ability to independently evaluate technical findings, control designs, and remediation approaches.
- Proven ability to build and improve security programs, independently identify control gaps and emerging requirements, establish priorities, and translate security risks into actionable organizational plans.
- Experience managing and developing security professionals, establishing high standards for quality and accountability, and leading programs across distributed teams.
- Experience with third-party risk assessments, customer security diligence, and security risk management, including the ability to evaluate complex technical and contractual security requirements.
- Strong written and verbal communication skills, sound judgment, and the ability to influence engineering teams, business leaders, auditors, and external stakeholders without relying solely on formal authority.
Условия
- $200,000/year - $260,000/year + equity + benefits
- Note: This salary range may be inclusive of several career levels, and the actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, and qualifications.
- Employer paid group health insurance for you and your dependents
- 401(k) plan with employer match (or equivalent for non US-based roles)
- Flexible paid time off
- Regular company-wide in-person events
- Home office stipend, and more!
Другое
- helps institutions and protects customers by accurately resolving identities and flagging fraud risk. Each day, we verify more than 3 million identities, flagging 150k+ fraud attempts in the process. The problems we work on are challenging, and solving them takes deep domain expertise, rigorous analysis, and a willingness to dig into the details.
- At , you'll work alongside smart, highly collaborative colleagues who respect each other's time and judgment, take ownership, and follow through on their commitments. Together, we do truly meaningful work protecting the identities of innocent consumers and flagging the fraudsters attempting to exploit them.
- We're well capitalized and growing quickly. We already serve 13 of the top 15 U.S. banks, we're expanding into new markets, and we're backed by Craft Ventures, Andreessen Horowitz, NYCA, and Max Levchin. We've been named to the Forbes Fintech 50 and as a 2026 FICO Industry Vanguard Decision Award Winner . We were also the first company to go live with the electronic Consent Based Social Security Number Verification (eCBSV) service, and we've testified before the U.S. Congress on the future of identity.
- We want to be the best place you've ever worked. We offer generous benefits and support a range of working arrangements, from fully remote to in-office. We are a digital-first company with strong collaboration across the U.S. and India, and we meet in person regularly to build relationships. We have offices in Austin, San Francisco, New York City, Seattle (Bellevue), Los Angeles, and Chicago in the U.S., and in Gurugram (Delhi) and Bengaluru in India.
- Follow Through
- Deep Understanding
- Whatever It Takes
- Do Something Smart