Security GRC Lead: Risk, Compliance & Strategy

drivewealth; United States; Remote; USD 180,000 - 320,000; Full time

Benefits offered by this job

Base + bonus + equity

401(k) plan with match

Extensive healthcare coverage (dental,

Vision, disability)

Paid time off & holidays

Personal development allowance

Wellness reimbursement

Company-provided phone

Job summary

DriveWealth is seeking a senior security leader to own the governance, risk, and compliance program within a regulated broker-dealer and embedded fintech environment. Reporting to the CISO, this role translates complex regulatory risk into business decisions, matures risk management frameworks, and stands up threat intelligence, incident response readiness, and third-party due-diligence capabilities.

You will work across security, risk, and the executive team to quantify enterprise risk and

Qualifications

• Experience leading security GRC in regulated financial services.
• Familiarity with NIST CSF, NIST 800-53, ISO 27001, SOC 2 and CIS Controls.
• Ability to interface with regulators, auditors, and executives.
• Knowledge of SEC, FINRA, GDPR/CCPA/GLBA data protections.

Responsibilities

• Lead enterprise GRC program and align controls with frameworks.
• Maintain cybersecurity policy library with reviews and ownership.
• Operate risk register, conduct risk assessments and track residual risk.
• Ensure SEC and FINRA obligations compliance and recordkeeping.
• Lead audits (SOC 1/2, ISO 27001) and remediation tracking.
• Establish testing and continuous monitoring, close gaps with owners.
• Support threat intelligence, incident readiness, and third-party due-diligence.

Skills

GRC leadership

Regulated financial services

NIST CSF & 800-53

ISO 27001 / SOC 2 knowledge

Regulatory compliance

Risk assessment & treatment

Policy lifecycle management

Stakeholder communication

Job description

DriveWealth is seeking a senior security leader to own the governance, risk, and compliance program within a regulated broker-dealer and embedded fintech environment. Reporting to the CISO, this role translates complex regulatory risk into business decisions, matures risk management frameworks, and stands up threat intelligence, incident response readiness, and third-party due-diligence capabilities.

You will work across security, risk, and the executive team to quantify enterprise risk and