Head of Security GRC

Overview

Lead the governance, risk and compliance (GRC) program for DriveWealth's security organization in a SEC/FINRA-regulated broker-dealer environment. Reports directly to the CISO and also owns security metrics, executive and board reporting, threat intelligence, incident-response readiness, and third-party and client cyber due diligence.

What you'll do

• Own and mature the enterprise GRC program, aligning controls to NIST CSF, NIST 800-53, ISO 27001, SOC 2 and CIS Controls.
• Maintain the cybersecurity policy, standard and procedure library, running the annual review cycle and managing control ownership, exceptions and waivers.
• Operate the information security risk register: conduct risk assessments, define treatment plans, facilitate risk-acceptance workflows and track residual risk.
• Ensure compliance with SEC/FINRA requirements, including Regulation S-P (Safeguards & Disposal), Rule 17a-4 recordkeeping, and financial-industry security obligations.
• Manage external and internal security audits and examinations, including SOC 1, SOC 2 Type II and ISO 27001, coordinating auditors, evidence collection and remediation tracking.
• Establish and run control testing and continuous control monitoring, driving remediation of gaps to closure across control owners.
• Establish procedures for annual security due-diligence reviews with critical partners and vendors.
• Maintain and enforce compliance with GDPR, CCPA/CPRA, LGPD and GLBA.
• Interpret and operationalize evolving SEC cybersecurity risk-management and incident-disclosure obligations.
• Assess and manage applicability of NYDFS 500, PCI DSS and state breach-notification requirements to the control environment.
• Serve as subject-matter expert for security compliance, providing guidance to business units, product and engineering.
• Partner with Legal, Privacy and Compliance teams to ensure end-to-end regulatory adherence.
• Design and maintain a security metrics, KPI and KRI framework measuring control effectiveness, risk posture and program maturity.
• Build and deliver executive dashboards and board-level reporting, translating technical risk into business and financial impact for the CISO, audit committee and board.
• Track and report remediation SLAs, risk-trend lines, control-maturity progression and audit-finding closure.
• Produce reporting packages supporting regulatory exams, partner assurance and internal governance committees.
• Stand up and operate a cyber threat-intelligence capability tuned to financial services, broker-dealers and embedded finance, using MITRE ATT&CK and sector sources such as FS-ISAC.
• Produce strategic, operational and tactical threat reporting for technical teams and executive stakeholders.
• Integrate threat intelligence into risk assessments, control decisions and incident-response readiness.
• Monitor for threats to partners and the broader supply chain that could create downstream client or platform risk.
• Own, maintain and regularly test the Incident Response Plan, and develop runbooks for ransomware, business email compromise, account takeover, data exposure and partner breach.
• Plan and facilitate tabletop exercises across security, engineering, legal, compliance and executive leadership.
• Map response procedures to regulatory and contractual notification requirements, including SEC incident disclosure, Reg S-P breach notification, state laws and partner SLAs.
• Lead post-incident reviews and lessons-learned, translating findings into control and process improvements.
• Own the end-to-end vendor risk lifecycle: intake, risk tiering, security due diligence, contractual security terms, ongoing monitoring and secure offboarding.
• Partner with Legal, Procurement, IT and Compliance on the TPRA process and security controls embedded in vendor evaluations.
• Assess concentration, fourth-party and SaaS supply-chain risk, escalating material exposures to the CISO.
• Maintain the vendor inventory and reassessment cadence, and establish minimum security requirements for vendors handling regulated or sensitive data.
• Own responses to inbound security questionnaires, RFPs and enterprise-client due-diligence requests, serving as security SME during partner evaluations.
• Build and maintain a reusable security trust package (SOC 2 report, penetration-test summaries, questionnaire libraries and security whitepaper).
• Partner with Sales, Partnerships and Legal to translate client security requirements into commitments the platform can meet and evidence.
• Establish standardized due-diligence procedures and scoring so client and partner assessments are consistent, repeatable and defensible.
• Act as a key liaison between internal business units, regulators and external partners on security matters.
• Communicate security posture, risk and compliance to senior leadership, represent the company in regulatory discussions, industry panels and conferences, and mentor teammates on GRC practices.

What you'll need

• 15+ years of experience in information security, risk management or cybersecurity roles.
• Significant time in a regulated financial-services environment.
• Prior ownership of a GRC function.
• Strong, practical understanding of SEC/FINRA regulations applicable to broker-dealers (e.g., Reg S-P, Rule 17a-4, cyber disclosure obligations).
• Expertise in global data-protection laws (GDPR, CCPA/CPRA, LGPD) and their operational impact.
• Hands-on experience leading GRC programs and risk-management initiatives end to end.
• Demonstrated ownership of SOC 1, SOC 2 and ISO 27001 examinations and compliance audits.
• Experience building security KPIs/KRIs and executive or board-level reporting.
• Working knowledge of threat intelligence, incident-response planning and runbook development.
• Proven third-party risk management and client/partner security due-diligence.
• Excellent communication and leadership skills, with the ability to work independently and drive to completion.

Nice to have

• Experience at a broker-dealer, fintech, or embedded-finance / brokerage-as-a-service company.
• Exposure to multi-jurisdiction and cross-border regulatory and privacy environments.
• Familiarity with MITRE ATT&CK, FS-ISAC and financial-sector threat landscapes.
• Hands-on experience with GRC/IRM and TPRM platforms and reporting/BI tooling.
• Relevant certifications: CISM, CISSP, CRISC, CISA, or ISO 27001 Lead Auditor (highly preferred).

Details

• Location: New York City, Chicago, Austin, Dallas, Denver, Miami, San Francisco Bay Area, or Seattle. Candidates outside these locations are not a fit and remote work outside them cannot be accommodated.
• New York or Chicago: in office on a cadence set by the Hiring Manager/Team.
• Austin, Dallas, Denver, Miami, San Francisco or Seattle: fully remote, with occasional visits to onsite offices.
• Must be authorized to work in the U.S. on a full-time basis without current or future visa sponsorship; DriveWealth does not sponsor employment visas at this time.
• Pay range: $270,000 – $290,000 USD.