Security Operations & GRC Lead

The company is a newly established fintech and trust bank focused on digital payments and digital asset infrastructure. The Founding Security Operations & GRC Lead will own security operations execution and governance across cloud infrastructure, enterprise technology, product platforms, and third-party vendors, while coordinating remediation, risk management, audit evidence, and examination readiness.

Responsibilities:

• Manage day-to-day security operations across cloud, product, vendor, and enterprise technology environments
• Monitor and coordinate remediation of security findings from security tools, cloud monitoring services, and third-party assessments
• Review, triage, prioritize, track, and escalate security alerts and security-related issues
• Coordinate security incident response activities, including investigation support, escalation, evidence preservation, communications, and post-incident review
• Support cloud-security posture management within AWS environments
• Oversee security controls related to:
• IAM
• CloudTrail
• AWS Config
• Security Hub
• GuardDuty
• Inspector
• Macie
• KMS
• Secrets Manager
• WAF
• Backup and recovery controls
• Maintain cloud-security documentation and evidence for audits and examinations
• Maintain security control documentation, audit evidence, risk registers, and security exception records
• Support access governance activities, including user access reviews, privileged access certifications, and joiner/mover/leaver processes
• Prepare and organize security evidence for internal audits, external audits, regulatory examinations, and third-party reviews
• Assist with ongoing compliance and examination-readiness initiatives
• Coordinate security oversight activities involving critical third-party providers and security partners
• Review vendor security documentation, assessment results, penetration-test reports, and remediation plans
• Track vendor-related security issues and follow up on corrective actions
• Partner with engineering and platform teams to support secure SDLC controls
• Coordinate remediation activities for findings from:
• Vulnerability assessments
• Penetration tests
• Code reviews
• SAST tools
• Dependency scans
• Secrets scanning
• Container security reviews
• Track remediation progress and ensure timely closure of identified risks
• Maintain organized, accurate, and examination-ready security evidence
• Support regulatory readiness activities and ensure security controls remain properly documented and defensible
• Provide regular updates to leadership regarding security risks, incidents, remediation efforts, and control effectiveness

Requirements:

• 7+ years of experience in one or more of the following areas:
• Security Operations
• Cloud Security
• Information Security
• Technology Risk
• Incident Response
• Vulnerability Management
• GRC / Security Compliance
• Experience supporting security programs in regulated or audit-sensitive environments
• Strong understanding of:
• Incident response
• Alert triage
• Access reviews
• Vulnerability management
• Risk remediation
• Security control documentation
• Hands-on experience with AWS security services and cloud-security operations
• Experience working with SIEM, MDR, EDR, vulnerability management, identity management, and ticketing platforms
• Ability to coordinate effectively across technical teams, business stakeholders, and external partners
• Strong documentation, communication, and organizational skills
• Experience within:
• Banking
• Fintech
• Payments
• Trust companies
• Financial services
• Digital asset or custody environments
• Familiarity with:
• OCC examination readiness
• FFIEC guidance
• NIST CSF
• NIST 800-53
• SOC 2
• GLBA
• CIS Controls
• Experience supporting AWS multi-account cloud environments
• Exposure to digital assets, blockchain, stablecoins, wallets, custody platforms, or regulated payment systems
• Experience supporting Microsoft 365, endpoint security, identity governance, EDR, or SASE technologies
• Professional certifications such as:
• CISSP
• CISM
• CISA
• CCSP
• AWS Security Specialty
• GIAC
• Security+