Head of Security GRC
Core
Lead the enterprise Governance, Risk, and Compliance (GRC) program for a regulated broker-dealer, ensuring alignment with SEC/FINRA obligations, global data-protection laws, and cybersecurity frameworks while reducing enterprise risk.
Role type
Senior IC Head of Security GRC
Builds
Enterprise GRC frameworks, security metrics/KPI dashboards, threat intelligence capabilities, incident response plans, and vendor risk management processes.
Domain
Financial Services / Cybersecurity / Regulatory Compliance
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
GRC program management, risk assessment and treatment, regulatory compliance (SEC/FINRA/GDPR/CCPA), audit management, threat intelligence analysis, incident response planning, vendor risk management, executive reporting, control testing
Preferred skills
Experience with NIST CSF/800-53/ISO 27001/SOC 2, knowledge of NYDFS 500/PCI DSS, ability to translate technical risk to business decisions, stakeholder management with regulators and partners
Technologies
NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls, MITRE ATT&CK, FS-ISAC
Responsibilities
Own and mature the enterprise GRC program; maintain cybersecurity policy libraries; operate the information security risk register; manage external and internal security audits; establish control testing and continuous monitoring; stand up cyber threat-intelligence capability; own incident response planning and runbooks; manage end-to-end vendor risk lifecycle; lead client and partner cyber due diligence
Seniority
Senior, hands-on IC