DriveWealth - Head of Security GRC

• Governance, Risk & Compliance (GRC) • Own and mature the enterprise GRC program, aligning controls to recognized frameworks including NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS Controls. • Maintain and organize the cybersecurity policy, standard, and procedure library, running the annual review cycle and managing control ownership, exceptions, and waivers. • Operate the information security risk register: conduct risk assessments, define treatment plans, facilitate risk-acceptance workflows, and track residual risk over time. • Ensure compliance with SEC/FINRA requirements, including Regulation S-P (Safeguards & Disposal), Rule 17a-4 recordkeeping, and financial-industry security obligations. • Manage external and internal security audits and examinations, including SOC 1, SOC 2 Type II, and ISO 27001, coordinating auditors, evidence collection, and remediation tracking. • Establish and run control testing and continuous control monitoring, driving remediation of gaps to closure across control owners. • Establish procedures for annual security due-diligence reviews with critical partners and vendors. • Regulatory & Data Protection Compliance • Maintain and enforce compliance with global data-protection laws, including GDPR, CCPA/CPRA, LGPD, and GLBA. • Interpret and operationalize evolving SEC cybersecurity risk-management and incident-disclosure obligations relevant to registrants and broker-dealers. • Assess and manage applicability of NYDFS 500, PCI DSS, and state breach-notification requirements to the platform's control environment. • Serve as subject-matter expert (SME) for security compliance, providing guidance to business units, product, and engineering. • Partner with Legal, Privacy, and Compliance teams to ensure end-to-end regulatory adherence. • KPI, Metrics & Executive / Board Reporting • Design and maintain a security metrics, KPI, and KRI framework that measures control effectiveness, risk posture, and program maturity. • Build and deliver executive dashboards and board-level reporting, translating technical risk into clear business and financial impact for the CISO, audit committee, and board. • Track and report remediation SLAs, risk-trend lines, control-maturity progression, and audit-finding closure • Produce reporting packages that support regulatory exams, partner assurance, and internal governance committees. • Continuously refine metrics so leadership can make risk-informed investment and prioritization decisions. • Threat Intelligence & Reporting • Stand up and operate a cyber threat-intelligence capability tuned to financial services, broker-dealers, and embedded-finance ecosystems. • Track relevant threat actors, campaigns, and TTPs using frameworks such as MITRE ATT&CK, and leverage sector sources including FS-ISAC. • Produce strategic, operational, and tactical threat reporting for technical teams and executive stakeholders. • Integrate intelligence into risk assessments, control decisions, and incident-response readiness, ensuring emerging threats drive prioritized action. • Monitor for threats to partners and the broader supply chain that could create downstream client or platform risk. • Incident Response Planning & Runbooks • Own, maintain, and regularly test the Incident Response Plan (IRP), ensuring it reflects the current threat landscape and regulatory obligations. • Develop and maintain incident runbooks / playbooks for high-priority scenarios (e.g., ransomware, business email compromise, account takeover, data exposure, and third-party or partner breach). • Plan and facilitate tabletop exercises across security, engineering, legal, compliance, and executive leadership. • Map response procedures to regulatory and contractual notification requirements, including SEC incident disclosure, Reg S-P breach notification, state laws, and partner SLAs. • Lead post-incident reviews and lessons-learned, translating findings into control and process improvements. • Third-Party / Vendor Risk Management (TPRM) • Own the end-to-end vendor risk lifecycle: intake, risk tiering, security due diligence, contractual security terms, ongoing monitoring, and secure offboarding. • Partner with Legal, Procurement, IT, and Compliance on the TPRA process and security controls embedded in vendor evaluations. • Assess concentration, fourth-party, and SaaS supply-chain risk, escalating material exposures to the CISO. • Maintain the vendor inventory and reassessment cadence, ensuring critical suppliers are reviewed on a defined schedule. • Establish and enforce minimum security requirements for vendors handling regulated or sensitive data. • Client & Partner Cyber Due Diligence • Own responses to inbound security questionnaires, RFPs, and enterprise-client due-diligence requests, serving as the security SME during partner evaluations. • Build and maintain a reusable security trust package (SOC 2 report, penetration-test summaries, questionnaire libraries, and security whitepaper) to accelerate sales and partnership cycles. • Partner with Sales, Partnerships, and Legal to translate client security requirements into commitments the platform can meet and evidence. • Establish standardized due-diligence procedures and scoring so client and partner assessments are consistent, repeatable, and defensible. • Security Leadership & Stakeholder Engagement • Act as a key liaison between internal business units, regulators, and external partners on security matters. • Communicate effectively with senior leadership, providing regular updates on security posture, risk, and compliance. • Represent the company in regulatory discussions, industry panels, and security conferences as needed. • Provide expert guidance on security frameworks, standards, and industry best practices, and mentor teammates on GRC practices.