Head of Security GRC

maybe but instructions only mention using

for section headings. It didn't forbid other headings, but we should stick to

for main sections. Inside responsibilities we can just list items; we could keep subheadings as plain text or . Probably better to keep them as plain text within

or separate

. But we need to preserve all substantive info. Could embed subheading as inside

. That's acceptable. - Requirements: likely "You Bring" (the list of required experience). That's a list. - Qualifications: maybe "Special Knowledge (Nice To Have, But Not Required)"? That's nice-to-have, not required. Could be Qualifications? But Qualifications often includes required qualifications. However we have Requirements already. Qualifications could be certifications etc. The posting includes "Relevant certifications: CISM, CISSP, CRISC, CISA, or ISO 27001 Lead Auditor (highly preferred)." That's under Special Knowledge. Also "Experience at a broker-dealer..." etc. Those are nice-to-have. We could treat Special Knowledge as Qualifications (nice-to-have). But we need to decide. - Skills: maybe we can extract skills from responsibilities? But we could also leave Skills section empty if not explicit. The instruction: include a section ONLY when posting has real, specific content for it. So if we don't have explicit skills list, we should omit Skills. - Benefits: from "Working at DriveWealth" paragraph: competitive compensation, equity, 401(k) match, Medical insurance, Dental insurance, Vision insurance, Disability insurance, Paid Parental Leave, wellness reimbursement, company-provided phone, personal development allowance, generous PTO and observed holidays. That's benefits. - Pay: from "Pay Range: $270,000 – $290,000 USD". That's specific. - Schedule: from Location section: mentions hybrid schedule for NY/Chicago, fully remote for others, occasional office visits. That's schedule info. So we can include Schedule section. We must not repeat job title as heading. Not include Job ID etc. Remove boilerplate like EEO etc. There's none. We need to output only HTML fragment, no /, no markdown fences. We'll produce:

About the role

... (the paragraph)

Responsibilities

• Governance, Risk & Compliance (GRC): Own and mature the enterprise GRC program, aligning controls to recognized frameworks including NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS Controls. Maintain and organize the cybersecurity policy, standard, and procedure library, running the annual review cycle and managing control ownership, exceptions, and waivers. Operate the information security risk register: conduct risk assessments, define treatment plans, facilitate risk-acceptance workflows, and track residual risk over time. Ensure compliance with SEC/FINRA requirements, including Regulation S-P (Safeguards & Disposal), Rule 17a-4 recordkeeping, and financial-industry security obligations. Manage external and internal security audits and examinations, including SOC 1, SOC 2 Type II, and ISO 27001, coordinating auditors, evidence collection, and remediation tracking. Establish and run control testing and continuous control monitoring, driving remediation of gaps to closure across control owners. Establish procedures for annual security due-diligence reviews with critical partners and vendors.
• Regulatory & Data Protection Compliance: Maintain and enforce compliance with global data-protection laws, including GDPR, CCPA/CPRA, LGPD, and GLBA. Interpret and operationalize evolving SEC cybersecurity risk-management and incident-disclosure obligations relevant to registrants and broker-dealers. Assess and manage applicability of NYDFS 500, PCI DSS, and state breach-notification requirements to the platform's control environment. Serve as subject-matter expert (SME) for security compliance, providing guidance to business units, product, and engineering. Partner with Legal, Privacy, and Compliance teams to ensure end-to-end regulatory adherence.
• KPI, Metrics & Executive / Board Reporting: Design and maintain a security metrics, KPI, and KRI framework that measures control effectiveness, risk posture, and program maturity. Build and deliver executive dashboards and board-level reporting, translating technical risk into clear business and financial impact for the CISO, audit committee, and board. Track and report remediation SLAs, risk-trend lines, control-maturity progression, and audit-finding closure. Produce reporting packages that support regulatory exams, partner assurance, and internal governance committees. Continuously refine metrics so leadership can make risk-informed investment and prioritization decisions.
• Threat Intelligence & Reporting: Stand up and operate a cyber threat-intelligence capability tuned to financial services, broker-dealers, and embedded-finance ecosystems. Track relevant threat actors, campaigns, and TTPs using frameworks such as MITRE ATT&CK, and leverage sector sources including FS-ISAC. Produce strategic, operational, and tactical threat reporting for technical teams and executive stakeholders. Integrate intelligence into risk assessments, control decisions, and incident-response readiness, ensuring emerging threats drive prioritized action. Monitor for threats to partners and the broader supply chain that could create downstream client or platform risk.
• Incident Response Planning & Runbooks: Own, maintain, and regularly test the Incident Response Plan (IRP), ensuring it reflects the current threat landscape and regulatory obligations. Develop and maintain incident runbooks / playbooks for high-priority scenarios (e.g., ransomware, business email compromise, account takeover, data exposure, and third-party or partner breach). Plan and facilitate tabletop exercises across security, engineering, legal, compliance, and executive leadership. Map response procedures to regulatory and contractual notification requirements, including SEC incident disclosure, Reg S-P breach notification, state laws, and partner SLAs. Lead post-incident reviews and lessons-learned, translating findings into control and process improvements.
• Third-Party / Vendor Risk Management (TPRM): Own the end-to-end vendor risk lifecycle: intake, risk tiering, security due diligence, contractual security terms, ongoing monitoring, and secure offboarding. Partner with Legal, Procurement, IT, and Compliance on the TPRA process and security controls embedded in vendor evaluations. Assess concentration, fourth-party, and SaaS supply-chain risk, escalating material exposures to the CISO. Maintain the vendor inventory and reassessment cadence, ensuring critical suppliers are reviewed on a defined schedule. Establish and enforce minimum security requirements for vendors handling regulated or sensitive data.
• Client & Partner Cyber Due Diligence: Own responses to inbound security questionnaires, RFPs, and enterprise-client due-diligence requests, serving as the security SME during partner evaluations. Build and maintain a reusable security trust package (SOC 2 report, penetration-test summaries, questionnaire libraries, and security whitepaper) to accelerate sales and partnership cycles. Partner with Sales, Partnerships, and Legal to translate client security requirements into commitments the platform can meet and evidence. Establish standardized due-diligence procedures and scoring so client and partner assessments are consistent, repeatable, and defensible.
• Security Leadership & Stakeholder Engagement: Act as a key liaison between internal business units, regulators, and external partners on security matters. Communicate effectively with senior leadership, providing regular updates on security posture, risk, and compliance. Represent the company in regulatory discussions, industry panels, and security conferences as needed. Provide expert guidance on security frameworks, standards, and industry best practices, and mentor teammates on GRC practices.

Requirements

• 15+ years of experience in information security, risk management, or cybersecurity roles, with significant time in a regulated financial-services environment and prior ownership of a GRC function.
• Strong, practical understanding of SEC/FINRA regulations applicable to broker-dealers (e.g., Reg S-P, Rule 17a-4, cyber disclosure obligations).
• Expertise in global data-protection laws (GDPR, CCPA/CPRA, LGPD) and their operational impact.
• Hands-on experience leading GRC programs and risk-management initiatives end to end.
• Demonstrated ownership of SOC 1, SOC 2, and ISO 27001 examinations and compliance audits.
• Experience building security KPIs/KRIs and executive or board-level reporting.
• Working knowledge of threat intelligence, incident-response planning, and runbook development.
• Proven third-party risk management and client/partner security due-diligence.
• Excellent communication and leadership skills, with the ability to work independently and drive to completion.

Qualifications

• Experience at a broker-dealer, fintech, or embedded-finance / brokerage-as-a-service (nice to have).
• Exposure to multi-jurisdiction / cross-border regulatory and privacy environments (nice to have).
• Familiarity with MITRE ATT&CK, FS-ISAC, and financial-sector threat landscapes (nice to have).
• Hands-on experience with GRC/IRM and TPRM platforms and reporting/BI tooling (nice to have).
• Relevant certifications: CISM, CISSP, CRISC, CISA, or ISO 27001 Lead Auditor (highly preferred).

We could also include Skills section if we want to pull out skills like "risk management", "GRC", etc. But we already have Requirements and Qualifications. Skills might be redundant. Safer to omit Skills if not explicit.

Benefits

• Competitive compensation
• Equity
• 401(k) match
• Medical insurance
• Dental insurance
• Vision insurance
• Disability insurance
• Paid Parental Leave
• Wellness reimbursement
• Company-provided phone