Technical Chief of Staff

Casap; New York, San Francisco (NY, CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Casap in New York, NY is seeking a Technical Chief of Staff to align critical initiatives across engineering, security, product, and legal. You will own the due diligence process for banks and fintechs, drive security questionnaires, and ensure SOC 2 and PCI DSS readiness with clear ownership and deadlines.

You will work closely with founders, translate ambitious goals into scoped programs, and maintain comprehensive documentation and controls to win enterprise trust from banking partners.

Qualifications

• 3+ years in chief of staff, technical program management, security compliance, or a similar cross-functional role.
• Working knowledge of SOC 2 and PCI DSS, and comfort managing an audit cycle.
• Enough technical depth to discuss APIs, data flows, infrastructure, and access controls without needing an engineer in the room.
• Experience responding to enterprise security questionnaires or vendor due diligence, especially with banks or regulated institutions.
• Exceptional written communication and documentation habits.
• Comfort with ambiguity and a bias toward owning the unowned.

Responsibilities

• Progress tracking on key initiatives across three tracks: new experiences, foundational investments, and client focused initiatives.
• Run recurring reviews with engineering, product, and go-to-market leads to surface status, risks, and blockers.
• Translate ambiguous goals into scoped workstreams with owners, milestones, and success criteria.
• Report progress to the founders and the broader team with clear signals on what is on track, what is at risk, and what needs a decision.
• Own the end-to-end diligence process for banks, fintechs, and credit unions evaluating Casap.
• Manage diligence responses including security questionnaires, vendor risk assessments, and architecture reviews.
• Build and maintain a reusable answer library so responses get faster and more consistent over time.
• Coordinate subject matter experts across engineering, security, and legal to close out requests on deadline.
• Drive our SOC 2 program including evidence collection, control ownership, auditor coordination, and remediation tracking.
• Support PCI compliance requirements and keep scope, documentation, and attestations current.
• Manage certificates of insurance, including renewals and client-specific requests.
• Keep policies, records, and audit artifacts organized and ready to produce on request.
• Run monthly security reviews with engineering and leadership covering access, vulnerabilities, incidents, and open findings.
• Track remediation items to closure and accelerate when timelines slip.
• Maintain reporting that gives clients and internal stakeholders confidence in our security posture.

Skills

Security compliance

Program management

Cross-functional coordination

Communication

Audit coordination

Vendor risk assessments

SOC 2

PCI DSS

Documentation

APIs

Data flows

Access controls

Job description

Location(s)

This is a hybrid role based out of our San Francisco, CA or New York, NY office. Our team works in-office time on Mondays, Wednesdays, and Fridays.

About the Role

Casap is looking for a Technical Chief of Staff to keep our most important initiatives on track and to own the programs that let us sell to and operate with the largest financial institutions in the US.

As the Technical Chief of Staff, you will sit next to the founders and run the connective tissue of the company. You will track progress on the initiatives that matter most, drive our due diligence responses with prospective and existing clients, and own the compliance programs that make Casap enterprise ready.

This is a high-context, high-ownership role. You will move between roadmap reviews, security questionnaires, audit evidence, and vendor conversations on the same day. Success looks like nothing slipping, every commitment having a clear owner and date, and our banks trusting us because our documentation and controls hold up under scrutiny.

What You'll Do

Progress Tracking on Key Initiatives

• Maintain a single source of truth for company initiatives across three tracks: new experiences, foundational investments, and client focused initiatives.
• Run recurring reviews with engineering, product, and go-to-market leads to surface status, risks, and blockers before they become escalations.
• Translate ambiguous goals into scoped workstreams with owners, milestones, and success criteria.
• Report progress to the founders and the broader team with clear signals on what is on track, what is at risk, and what needs a decision.

Due Diligence Program

• Own the end-to-end diligence process for banks, fintechs, and credit unions evaluating Casap.
• Manage diligence responses including security questionnaires, vendor risk assessments, and architecture reviews.
• Build and maintain a reusable answer library so responses get faster and more consistent over time.
• Coordinate subject matter experts across engineering, security, and legal to close out requests on deadline.

Compliance

• Drive our SOC 2 program including evidence collection, control ownership, auditor coordination, and remediation tracking.
• Support PCI compliance requirements and keep scope, documentation, and attestations current.
• Manage certificates of insurance, including renewals and client-specific requests.
• Keep policies, records, and audit artifacts organized and ready to produce on request.

Monthly Security Reviews

• Run monthly security reviews with engineering and leadership covering access, vulnerabilities, incidents, and open findings.
• Track remediation items to closure and accelerate when timelines slip.
• Maintain reporting that gives clients and internal stakeholders confidence in our security posture.

What You've Done

• 3+ years in chief of staff, technical program management, security compliance, or a similar cross-functional role, ideally at a startup or in fintech.
• Working knowledge of compliance frameworks such as SOC 2 and PCI DSS, and comfort managing an audit cycle.
• Enough technical depth to hold a credible conversation about APIs, data flows, infrastructure, and access controls without needing an engineer in the room.
• Experience responding to enterprise security questionnaires or vendor due diligence, especially with banks or regulated institutions.
• Exceptional written communication and documentation habits. You default to writing things down.
• Comfort with ambiguity and a bias toward owning the unowned.