Remote Position
[Remote] Security Operations & GRC Lead
🌍 Remote · United States
💼 Full-time
Note: The job is a remote job and is open to candidates in USA. The company is a newly established fintech and trust bank focused on digital payments and digital asset infrastructure. The Founding Security Operations & GRC Lead will own security operations execution and governance across cloud infrastructure, enterprise technology, product platforms, and third-party vendors, while coordinating remediation, risk management, audit evidence, and examination readiness.
Responsibilities
- Manage day-to-day security operations across cloud, product, vendor, and enterprise technology environments
- Monitor and coordinate remediation of security findings from security tools, cloud monitoring services, and third-party assessments
- Review, triage, prioritize, track, and escalate security alerts and security-related issues
- Coordinate security incident response activities, including investigation support, escalation, evidence preservation, communications, and post-incident review
- Support cloud-security posture management within AWS environments
- Oversee security controls related to:
- IAM
- CloudTrail
- AWS Config
- Security Hub
- GuardDuty
- Inspector
- Macie
- KMS
- Secrets Manager
- WAF
- Backup and recovery controls
- Maintain cloud-security documentation and evidence for audits and examinations
- Maintain security control documentation, audit evidence, risk registers, and security exception records
- Support access governance activities, including user access reviews, privileged access certifications, and joiner/mover/leaver processes
- Prepare and organize security evidence for internal audits, external audits, regulatory examinations, and third-party reviews
- Assist with ongoing compliance and examination-readiness initiatives
- Coordinate security oversight activities involving critical third-party providers and security partners
- Review vendor security documentation, assessment results, penetration-test reports, and remediation plans
- Track vendor-related security issues and follow up on corrective actions
- Partner with engineering and platform teams to support secure SDLC controls
- Coordinate remediation activities for findings from:
- Vulnerability assessments
- Penetration tests
- Code reviews
- SAST tools
- Dependency scans
- Secrets scanning
- Container security reviews
- Track remediation progress and ensure timely closure of identified risks
- Maintain organized, accurate, and examination-ready security evidence
- Support regulatory readiness activities and ensure security controls remain properly documented and defensible
- Provide regular updates to leadership regarding security risks, incidents, remediation efforts, and control effectiveness
Skills
- 7+ years of experience in one or more of the following areas:
- Security Operations
- Cloud Security
- Information Security
- Technology Risk
- Incident Response
- Vulnerability Management
- GRC / Security Compliance
- Experience supporting security programs in regulated or audit-sensitive environments
- Strong understanding of:
- Incident response
- Alert triage
- Access reviews
- Vulnerability management
- Risk remediation
- Security control documentation
- Hands-on experience with AWS security services and cloud-security operations
- Experience working with SIEM, MDR, EDR, vulnerability management, identity management, and ticketing platforms
- Ability to coordinate effectively across technical teams, business stakeholders, and external partners
- Strong documentation, communication, and organizational skills
- Experience within:
- Banking
- Fintech
- Payments
- Trust companies
- Financial services
- Digital asset or custody environments
- Familiarity with:
- OCC examination readiness
- FFIEC guidance
- NIST CSF
- NIST 800-53
- SOC 2
- GLBA
- CIS Controls
- Experience supporting AWS multi-account cloud environments
- Exposure to digital assets, blockchain, stablecoins, wallets, custody platforms, or regulated payment systems
- Experience supporting Microsoft 365, endpoint security, identity governance, EDR, or SASE technologies
- Professional certifications such as:
- CISSP
- CISM
- CISA
- CCSP
- AWS Security Specialty
- GIAC
- Security+
Benefits
- Remote work flexibility within the United States
Company Overview
Company H1B Sponsorship