Information Security Lead

novacredit; New York (NY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Nova Credit seeks an Information Security Lead to bridge hands-on security work and governance, risk, and compliance across the org. You will harden systems, configure tooling, investigate alerts, and respond to customer security questionnaires and audits with the Director of Information Security.

You will partner across Engineering, Product and Data Science, own security program initiatives, and help scale controls as Nova grows in a hybrid NYC setting.

Qualifications

• 3–6+ years in information security, security engineering, cloud security, or technical GRC.

Responsibilities

• Within the first month: Develop understanding of Nova Credit's products, AWS infrastructure, and key data flows from a security perspective.
• Within the first quarter: Own customer security questionnaires end-to-end, from intake to evidence to responses and follow-up calls.
• Within the first year: Own an agreed slice of the security program end-to-end with measurable outcomes.

Skills

Information security

Security engineering

Cloud security

GRC

EDR

MDM

SSO/IAM

DLP

AWS security

Tools

Jamf

SentinelOne

Okta

Job description

Nova Credit is a credit infrastructure and analytics company that enables businesses to grow responsibly by harnessing alternative credit data. The company leverages its unique data infrastructure, industry-leading analytics & FCRA-compliance to help lenders fill in the gaps that exist in traditional credit analytics. Nova Credit provides access to the fragmented universe of consumer financial data and transforms it into compliant, actionable risk analytics through a suite of solutions designed to increase conversion through expanded coverage, speed, and reliability. Nova Credit supports over 7,000 businesses including organizations such as HSBC, SoFi, Scotiabank, AppFolio, and Yardi, who work with Nova Credit to make smarter credit decisions through cash flow underwriting with Cash Atlas™, quickly and accurately verify income with Income Navigator, verify income and assets with Eligibility Compass, and reach new-to-country consumers with Credit Passport®. We were named in Forbes' Fintech 50 in 2025 and Built In's Best Places to Work, 2025 .

As Nova Credit's Information Security Lead, you will be a hands-on, all-rounder security practitioner at the heart of our InfoSec function. You will partner closely with the Director of Information Security to mature our security program, moving fluidly between deep-in-the-weeds technical work (configuring tooling, hardening systems, investigating alerts, automating controls) and the Governance, Risk, and Compliance (GRC) work that earns us the trust of some of the world's largest financial institutions (responding to customer security questionnaires, supporting SOC 2 and ISO 27001 audits, executing on our control sets, and running third-party risk reviews).

This role is built for someone who is happy doing both. You bring an engineer's instinct for solving security problems with configuration, and the practitioner's patience for the questionnaire and audit work that proves out our controls. You will work cross-functionally with the rest of the company, while you will own meaningful technical and program-level initiatives from your first quarter.

This is a hybrid role (3 days per week in office on Mondays, Tuesdays, and Thursdays) based in the New York City Metropolitan area.

WITHIN THE FIRST MONTH, YOU'LL:

• Develop a working understanding of Nova Credit's products, our AWS-based infrastructure, and the data flows that matter most from a security perspective.
• Familiarize yourself with our control sets, frameworks, and policies (SOC 2 Type II, ISO 27001, internal standards) and our existing inventory of customer-facing security commitments.
• Get hands-on with our security tooling stack, EDR, MDM, SSO/IAM, DLP, cloud security posture management, etc.
• Shadow incoming customer security questionnaires and due diligence reviews to learn the cadence, the source-of-truth artifacts, and our standard responses.
• Pick up your first hands-on tickets, things like endpoint hardening, MDM tuning, IAM cleanup, or evidence collection, to build operational muscle memory.
• Meet your stakeholders across the rest of the company.

WITHIN THE FIRST QUARTER, YOU'LL:

• Start to own customer security questionnaires and due diligence reviews end-to-end, from intake, to evidence pulls, to clean responses, to the follow-up calls.
• Configure, tune, and operate security tooling across our stack (EDR, MDM, SSO/IAM, DLP, Google Workspace settings).
• Triage and respond to security alerts, bug bounty reports, and internal escalations; document repeatable response runbooks for what you handle.
• Contribute to third-party risk reviews of new vendors and re-reviews of existing critical suppliers.
• Surface and propose fixes for at least one process gap or control weakness you identify during onboarding.

WITHIN THE FIRST YEAR, YOU'LL:

• Own an agreed-on slice of Nova Credit's security program end-to-end, e.g., IAM/SSO, endpoint and MDM, vulnerability management, customer-trust/questionnaire program, or third-party risk, with clear, measurable outcomes.
• Own customer security questionnaires and due diligence reviews end-to-end, from intake to evidence pulls, to clean responses, and attending follow-up calls.
• Drive at least one significant hardening or modernization initiative
• Be a go-to internal expert for technical security questions from Engineering, Product and Data Science
• Partner with the Director of Information Security on roadmap, prioritization, and how our Information Security program scales as Nova grows

YOUR SKILLSET:

• Experience : 3-6+ years across information security, security engineering, cloud security, or technical GRC roles, ideally with at least some time in a high-growth fintech, financial services, or regulated SaaS environment.
• Hands-on technical depth : Comfortable configuring and operating modern security tooling such asEDR, MDM, SSO/IAM, DLP, and cloud security tooling. Knowledge of Jamf, SentinelOne, Okta are a plus
• Cloud security : Working knowledge of AWS security, IAM, ne