Head of GRC

JustMarkets; United States; Remote; USD 180,000 - 260,000; Full time

Benefits offered by this job

Remote work opportunity

Professional education budget

Language learning budget

Wellness budget (gym membership, gear)

Job summary

JustMarkets is seeking an experienced Head of Information Security GRC to lead and evolve our governance, risk and compliance function in a growing FinTech. This hands-on leadership role shapes the GRC operating model, roadmap, and core processes while collaborating with Security, Legal, Risk, IT, Engineering, Product, and business teams.

You will build practical controls, oversee audits, and drive risk-based decisions, with a focus on scalable, repeatable processes and automation.

Qualifications

• Strong practical experience in Information Security GRC, cyber/technology risk, security compliance, or assurance.
• Hands-on experience with frameworks such as SOC 2, ISO 27001, DORA, PCI DSS, NIST CSF, COBIT, or similar.
• Experience establishing or operating security controls, risk registers, exception processes, and assurance programs.
• Ability to translate regulatory and security requirements into practical controls and processes.
• Strong stakeholder management skills for technical, business, and executive audiences.
• Experience leading a team, function, program, or cross-functional initiatives.

Responsibilities

• Own and develop the Information Security GRC strategy, roadmap, operating model, and governance cadence.
• Lead security governance, regulatory assurance, cyber risk, and third-party risk oversight.
• Establish ownership for security controls, risks, exceptions, evidence, and remediation actions.
• Coordinate audits and regulatory requests (SOC 2, DORA/CySEC) and assurance activities.
• Maintain risk registers and ensure material risks are treated, accepted, or escalated.
• Develop security policies, standards, controls, and guidance.
• Prepare concise GRC and risk reporting for CISO and executives.
• Build and manage the GRC team with clear goals and performance expectations.

Skills

Information Security GRC

SOC 2

ISO 27001

DORA

PCI DSS

NIST CSF

COBIT

Audits coordination

Policy development

Stakeholder management

Cloud/infrastructure/identity security

Team leadership

Job description

We are looking for an experienced Head of Information Security GRC to lead and develop our Information Security Governance, Risk & Compliance function.

This is a hands-on leadership role with the opportunity to shape the GRC operating model, roadmap, team, and core processes in a growing international FinTech environment.

You will work directly with the CISO and collaborate closely with Security, Legal, Risk, Procurement, IT, Engineering, Product, Platform, HR, and business teams.

The role combines security governance, cyber risk, regulatory assurance, third-party risk, policy management, and security awareness, with a strong focus on building practical controls and processes that support business growth.

Responsibilities

• Own and develop the Information Security GRC strategy, roadmap, operating model, and governance cadence
• Lead security governance, regulatory assurance, cyber risk, third-party security risk, policy lifecycle, and security-awareness oversight
• Establish clear ownership for security controls, risks, exceptions, evidence, and remediation actions
• Coordinate SOC 2, DORA/CySEC-related assurance, internal and external audits, and regulatory requests
• Maintain cyber-risk and exception registers and ensure material risks are treated, accepted, or escalated
• Lead security aspects of ICT supplier tiering, due diligence, reassessment, and high-risk supplier decisions
• Develop practical security policies, standards, controls, and guidance
• Ensure audit and assurance evidence is reliable, traceable, and reusable
• Track control gaps, findings, and remediation commitments and escalation
• Partner with Security, IT, Engineering, Product, Platform, Legal, and business teams on control design and risk-based decisions
• Prepare concise GRC and risk reporting for the CISO and executive stakeholders
• Build, develop, and manage the GRC team, including responsibilities, goals, and performance expectations
• Improve GRC efficiency through automation, reusable evidence, better data quality, and responsible AI-assisted workflows

Requirements

• Strong practical experience in Information Security GRC, cyber/technology risk, security compliance, or assurance
• Hands-on experience with recognized frameworks such as SOC 2, ISO 27001, DORA, PCI DSS, NIST CSF, COBIT, or similar
• Experience establishing or operating security controls, risk registers, exception processes, and assurance programs
• Strong understanding of control design, operating effectiveness, evidence quality, findings, and remediation
• Experience coordinating internal or external audits and regulatory or assurance activities
• Practical experience with cyber risk assessment, risk treatment, risk acceptance, and escalation
• Understanding of third-party and ICT supplier security risk
• Ability to translate regulatory and security requirements into practical controls and processes
• Strong stakeholder management skills and ability to work effectively with technical, business, and executive audiences
• Sufficient technical understanding of cloud, infrastructure, identity, IT operations, and product development to work effectively with technical teams
• Experience leading a team, function, program, or complex cross-functional initiatives
• Strong ownership, prioritization, and decision‑making skills

We Offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays according to company policy
• Medical budget
• Remote work opportunity
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear, etc.)