About the Role
We are seeking a Security GRC Lead to spearhead security governance, risk, and compliance across the company's acquisitions. In this role, you will be responsible for integrating acquired companies into our security framework, working closely with the M&A Technology Team from diligence through to platform migration or steady-state coverage. This position is essential as the company continuously acquires companies across various jurisdictions, each with unique control environments, compliance histories, and readiness timelines. Your objective will be to establish a repeatable process for assessing acquired companies against our security baseline and setting realistic remediation milestones.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Key Responsibilities
-
Target Assessment
- Review target security posture during diligence: control environment, identity and access management, infrastructure, third-party dependencies, and prior audit or examination history.
- Produce a written assessment of each target against the company's security baseline, highlighting risks relevant to both the deal and steady-state operations.
- Provide clear insights to the M&A Technology Team and deal sponsors regarding the cost of control remediation for integration.
-
Control Mapping and Framework Onboarding
- Map acquired controls to the company's framework and relevant external frameworks.
- Determine which existing parent-company controls extend to the acquired entity, require modification, or have no counterparts.
- Develop specific policy libraries where existing policies do not suffice.
-
Remediation and Milestones
- Establish achievable milestones for the acquired team with designated owners and target dates, prioritizing high-risk gaps first.
- Track remediation progress and address overdue or significant risks, preparing rationale and compensating controls for risk acceptances for leadership review.
-
Program Integration
- Prepare acquired entities for external audit inclusion and facilitate their audit fieldwork.
- Ensure visibility of acquired entity risks in the enterprise risk register and related Security GRC reporting.
- Transition control of each entity to central GRC coverage once it meets maturity standards, ensuring documentation of the handover process.
- Facilitate integration of third-party vendors within the company's framework.
What You Bring
- 5-7+ years of experience in security governance, IT risk, or compliance, with a focus on regulated financial services, fintech, or virtual asset environments.
- Proven track record in onboarding acquired companies into existing compliance programs, which is central to this role.
- Familiarity with SOX/ICFR IT general controls and acceptable evidence for external audits.
- Experience with at least two of the following: ISO 27001, SOC 1, SOC 2, and PCI DSS, including cross-framework control mapping.
- Strong capability in assessing control maturity and devising feasible remediation plans for teams that may fall below the company's maturity levels.
- Hands-on approach: actively defining scope, collecting evidence, and addressing gaps as needed.
- Excellent judgment in prioritizing tasks amidst incomplete information, with a responsible approach to escalation.
- Ability to cultivate relationships with control owners in IAM, infrastructure, and engineering.
- Proficient in articulating control gaps in risk language suitable for executives and deal teams.
- Strong project management skills across cross-functional teams.
Preferred Qualifications
- CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer certifications.
- Experience in M&A or post-merger technology integrations.
- Familiarity with PKM.
Why This Role?
- You will own an essential domain independently, with no pre-existing processes, providing a unique opportunity to shape the role.
- Engage with one of the fastest-moving segments of the business, with security integration being pivotal to acquisitions.
- Collaborate directly with deal teams, leadership of acquired companies, external auditors, and Security GRC leadership, gaining insights into acquisition evaluations and closures.
- The controls you implement will be subject to external auditor testing as the company prepares for public company reporting.
- The scope of the role will expand in response to the acquisition pipeline across different regulations and territories.
- Join a remote-first, global team dedicated to innovation in financial infrastructure.
Commitment to Diversity
We celebrate diverse talents and backgrounds and hire based on merit, welcoming applicants from all walks of life. We encourage individuals who may not perfectly meet all requirements but are passionate about crypto to apply. As an equal opportunity employer, we do not tolerate discrimination of any kind.
