DriveWealth
Head of Security GRC
$270K–$290K
AMER - Remote, San Francisco · Director · Full-time · Posted Jul 21, 2026
- Experience
- 15+ years in information security, risk management, or cybersecurity, including significant time in regulated financial services and prior ownership of a GRC function.
- Visa sponsorship
- Applicants must be authorized to work in the U.S. full-time without current or future visa sponsorship; DriveWealth does not provide visa sponsorship or employment-authorization support, including transfers.
About the job
Leads DriveWealth’s security governance, risk, and compliance program for a regulated broker-dealer, including risk reporting, threat intelligence, incident-response readiness, and vendor and client due diligence.
What you'll do
- Own and mature GRC, regulatory compliance, audits, risk assessments, and control testing.
- Develop security metrics and executive/board reporting; build threat-intelligence and incident-response capabilities.
- Manage vendor risk and client/partner security due diligence, and liaise with regulators and business stakeholders.
What they ask for
- Strong practical understanding of SEC/FINRA regulations applicable to broker-dealers.
- Expertise in global data-protection laws, including GDPR, CCPA/CPRA, and LGPD.
- Hands-on experience leading GRC programs and risk-management initiatives end to end; ownership of SOC 1, SOC 2, and ISO 27001 examinations and audits.
- Experience with security KPIs/KRIs and executive or board reporting; working knowledge of threat intelligence, incident response, and third-party risk management.
Nice to have
- Experience in a broker-dealer, fintech, or embedded-finance / brokerage-as-a-service; exposure to cross-border regulatory and privacy environments.
- Familiarity with MITRE ATT&CK, FS-ISAC, GRC/IRM and TPRM platforms, or relevant certifications such as CISM, CISSP, CRISC, CISA, or ISO 27001 Lead Auditor.
Pay
$270,000 – $290,000 USD (base salary)
Tools
NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls, MITRE ATT&CK, FS-ISAC, PCI DSS
AI focus
The company encourages proactive use of emerging and internal AI tools to improve signal quality, reduce friction, outcomes, service, and process efficiency; no specific AI duties are listed for this role.
Model-written summary · the original posting is authoritative