Security risk manager in crypto

EMCD; United States; Remote; USD 120,000 - 190,000; Full time

Benefits offered by this job

Remote work

Flexible hours

20 days vacation + 12 days

Paid sick leave

English lessons

Growth support

Employee discounts

Mining infrastructure access

Job summary

EMCD объявляет набор специалиста по управлению киберрисками. Ваша задача — выстроить программу управления киберрисками, проводить аудиты и работать над регуляторными лицензиями в fintech/crypto среде.

Роль предполагает удалённую работу, гибкий график и работу с регуляторами. Требуется 4+ года опыта в Information Security Risk Management или GRC, знание стандартов и практик, умение общаться с руководством и аудиторами на русском и английском языках.

Qualifications

• 4+ лет опыта в управлении киберрисками информации или GRC, в финтехе или регулируемой среде.
• Опыт ведения реестра рисков и взаимодействия с бизнес-owners: оценка, лечение, контроль.
• Практический опыт в TPRM и работе с поставщиками.
• Знание стандартов ISO/IEC 27001/27005, NIST CSF, SP 800-30; качественная и количественная оценка рисков.
• Опыт подготовки к SOC 2 или ISO 27001: контрольные мероприятия и сбор доказательств.

Responsibilities

• Проведение оценок информационной безопасности при onboarding партнеров и поставщиков.
• Ведение и обновление риска-регистра, контроль исполнения планов снижения риска.
• Коммуникации по рискам: ежеквартальные синхронизации и доклады на уровне CIO/CEO.
• Координация проекта SOC 2 и подготовка этапа Type 2.
• Руководство командой Governance & Compliance (2 человека).

Skills

InfoSec RM

GRC

TPRM

Регуляторное лицензирование

Коммуникация с руководством

Русский язык

Английский язык

Tools

ISO 27001/27005

NIST CSF

SP 800-30

Job description

Описание

EMCD is a leading technology company in the crypto industry, best known as the largest mining pool in Eastern Europe. We are expanding globally and building a comprehensive ecosystem of crypto services, including payment infrastructure, custody, mining solutions and enterprise-grade tools for businesses and institutions. We are looking for an Security Risk Manager to take ownership of our cyber risk management program, drive security audits and regulatory licensing initiatives.

Задачи

• Conduct information security risk assessments of partners and vendors during onboarding: prepare reports, identify risks, and record risk treatment measures in the register.
• Maintain the IS risk register: elevate to risk owners, track and control the implementation of risk treatment plans.
• Risk communication: lead risk syncs and provide risk updates for C-level executives.
• SOC 2: coordinate projects and manage the IS track of the initiative, including risk assessment (CC3) and preparation for Type 2.
• Regulatory licensing (VASP): lead the IS portion of applications, perform initial cyber risk assessments, develop cyber risk management policies and procedures, and respond to regulator inquiries.
• Lead the Governance & Compliance team (2 people): planning, workload allocation, and team KPIs.

Требования

• 4+ years of experience in Information Security Risk Management or GRC, with a significant background in fintech, crypto, or another regulated environment.
• Experience maintaining a risk register and working directly with business risk owners: assessment, treatment plans, execution control.
• Practical experience in Third-Party Risk Management (TPRM).
• Knowledge of ISO 27001/27005, NIST CSF, or SP 800-30; understanding of qualitative and quantitative risk assessment methods.
• Experience preparing for SOC 2 or ISO 27001: controls, evidence collection, and auditor engagement.
• Experience working with regulatory requirements for IS (VASP, MiCA, DORA, or equivalents).
• Understanding of crypto infrastructure (custody, wallets, keys, HSM) at a risk assessment level.
• Ability to prepare concise, data-driven materials with clear proposed solutions for C-level executives.
• Fluent Russian and English (C1): documentation, audit collaboration, and regulatory communication.

Условия

• Remote-first company - work from anywhere in the world.
• Fully flexible working hours.
• Extended time off: 20 paid vacation days + 12 bonus days per year.
• 100% paid sick leave.
• Paid English lessons (iTalki).
• Professional growth support (courses, certifications, training programs).
• Real impact and ownership in fintech & crypto projects.
• Corporate benefits: EMCD product discounts and mining infrastructure access.
• Employment via Service Agreement.