Security GRC Lead: Post-Merger Compliance & Risk

Kraken; United States; Remote; USD 150,000 - 230,000; Full time

Job summary

Kraken is seeking a Security GRC Lead to own governance, risk, and compliance across Payward's acquisitions. You will bring each acquired company into our security program, mapping controls, defining remediation milestones, and guiding diligence through to full integration or steady-state coverage under our central program.

You will lead remediation sequencing, document risk baselines, and coordinate with the M&A Technology Team to ensure timely closure of gaps across multiple jurisdictions.

Qualifications

• 5-7+ years in security governance, IT risk, or compliance within regulated financial services, fintech, or virtual asset environments.
• Direct experience onboarding an acquired company into an existing controls or compliance program.
• Working knowledge of SOX/ICFR IT general controls and external auditors' evidence expectations.
• Experience with ISO 27001, SOC 1, SOC 2, or PCI DSS frameworks and mapping controls across frameworks.

Responsibilities

• Review target posture during diligence and post-close to align with Payward baseline.
• Map acquired controls to Payward framework and external frameworks, identifying variants and gaps.
• Define remediation milestones with clear owners and dates to reduce risk.
• Track remediation progress and escalate material risks to Security GRC leadership.
• Prepare acquired entities for external audit scope, including evidence collection and walkthrough support.
• Act as Security GRC point of contact for acquired-entity leadership, finance, and internal audit.

Skills

Security governance

IT risk

Compliance

Regulatory knowledge

Fintech

Post-merger integration

Job description

Kraken is seeking a Security GRC Lead to own governance, risk, and compliance across Payward's acquisitions. You will bring each acquired company into our security program, mapping controls, defining remediation milestones, and guiding diligence through to full integration or steady-state coverage under our central program.

You will lead remediation sequencing, document risk baselines, and coordinate with the M&A Technology Team to ensure timely closure of gaps across multiple jurisdictions.