DriveWealth
Head of Security GRC
$270K–$290K
AMER-US-Remote +7 · Remote · Director · Full-time · Posted Jul 21, 2026
- Location
- AMER-US-Remote
Austin, Texas, United States
Dallas, Texas, United States
Denver, Colorado, United States
Miami, Florida, United States
San Francisco, California, United States
Seattle, Washington, United States
AMER-US-Remote - Experience
- 15+ years.
- Visa sponsorship
- Applicants must be authorized to work in the United States without current or future visa sponsorship; the company does not provide sponsorship or employment-authorization transfers.
About the job
Leads DriveWealth’s security governance, risk, and compliance program for a regulated broker-dealer, including executive reporting, threat intelligence, incident readiness, and third-party and client security due diligence.
What you'll do
- Own and mature GRC, regulatory compliance, audits, risk assessments, and control monitoring.
- Build security metrics and executive/board reporting; establish threat-intelligence and incident-response capabilities.
- Lead vendor risk management and client/partner security assessments, and represent security with regulators and partners.
What they ask for
- 15+ years in information security, risk management, or cybersecurity, with significant regulated financial-services experience and prior GRC-function ownership.
- Practical understanding of SEC/FINRA broker-dealer regulations and global data-protection laws.
- Hands-on leadership of GRC and risk programs, including SOC 1, SOC 2, and ISO 27001 audits.
- Experience with security KPIs/KRIs and executive or board reporting; working knowledge of threat intelligence and incident response; proven third-party risk and client/partner due diligence.
Nice to have
- Experience at a broker-dealer, fintech, or embedded-finance / brokerage-as-a-service.
- Familiarity with MITRE ATT&CK, FS-ISAC, GRC/IRM or TPRM platforms; relevant certifications include CISM, CISSP, CRISC, CISA, or ISO 27001 Lead Auditor.
Pay
$270,000 – $290,000 USD (base salary)
Tools
NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls, MITRE ATT&CK, FS-ISAC, PCI DSS
AI focus
The company encourages employees to use emerging AI tools and internal technology to improve signal quality, reduce friction, outcomes, service, and process efficiency; no specific AI duties are listed for this role.
Model-written summary · the original posting is authoritative