Security & Risk Leader — Compliance, IR & Strategy

Jobtailor; New York (NY); On-site; USD 150,000 - 210,000; Full time

Job summary

Jobtailor is seeking an experienced information security and GRC leader in New York to build and own the enterprise risk program across security, regulatory, and vendor risk. You will drive audits, policy, and awareness training, ensuring audit-ready operations for all entities.

You will own SOC 2, ISO 27001, and related frameworks, coordinate auditors and third-party assessments, and design incident response and ISMS documentation. A strong track record in fintech or B2B SaaS is preferred.

Qualifications

• 7–10 years of information security, risk, GRC, or compliance operations with ownership.
• Hands-on knowledge of compliance frameworks (SOC 2, ISO 27001, and others).
• Experience implementing and managing GRC automation tools and audits.

Responsibilities

• Build M0’s enterprise risk program from scratch across security, operational, regulatory, and counterparty risk.
• Own M0's compliance posture across SOC 2, ISO 27001, and other frameworks—drive policy, audits, and vendor risk.
• Design and maintain incident response, ISMS docs, and security policies; manage external security vendor relationships.
• Coordinate security due diligence for partners and respond to questionnaires with reusable documentation.
• Design and own security awareness training; foster a proactive security culture across teams.

Skills

Information security

GRC

Compliance operations

Risk management

Audits

Security controls

BCP/DR planning

Vendor risk

ISO 27001

SOC 2

Tools

Vanta

Drata

AWS

Job description

Jobtailor is seeking an experienced information security and GRC leader in New York to build and own the enterprise risk program across security, regulatory, and vendor risk. You will drive audits, policy, and awareness training, ensuring audit-ready operations for all entities.

You will own SOC 2, ISO 27001, and related frameworks, coordinate auditors and third-party assessments, and design incident response and ISMS documentation. A strong track record in fintech or B2B SaaS is preferred.