What's the role about

The Security GRC Lead will be responsible for ensuring we meet all industry cybersecurity compliance standards and government regulations through developing governing policies, implementing the security control framework, conducting security risk and control assessments, and staying up-to-date on global compliance initiatives. The GRC Lead involves leading comprehensive risk and control assessments to identify, assess, treat, and monitor cybersecurity risks throughout Paysend’s products and enterprise. You will be responsible for working closely with cross-functional partners to evaluate risks and develop innovative mitigation strategies, provide ongoing compliance control support, and support various risk and control management projects. You should be enthusiastic about:

• Driving an industry-leading security risk and controls management program alongside a team of outstanding colleagues in the FinTech sector
• Thriving and growing in a fast-paced FinTech environment and being able to pivot priorities to adapt quickly to a constantly evolving & demanding Security GRC landscape
• Learning quickly and having a strong appetite for acquiring more and new knowledge in the realm of FinTech cybersecurity.
• Fostering collaboration and cross-functional partnerships to help spread awareness and drive the implementation of cybersecurity controls to mitigate challenging or unique risks
• Providing candid and clear feedback on critical cybersecurity initiatives from policies to product designs.
• Staying up-to-date on current emerging cybersecurity trends

What you’ll be doing

As a GRC Lead, you will be responsible for: 

• Driving the development and implementation of the cybersecurity risk and controls management program to ensure alignment with industry best practices and regulatory requirements including and PCI-DSS, SOC and ISO 27001 standards
• Driving the implementation and testing of a comprehensive cybersecurity controls framework while developing innovative risk mitigation strategies with product and business teams
• Driving collaboration with cross-functional teams to identify risks while evaluating the design and operational effectiveness of controls to report opportunities for improvement 
• Driving collaboration with security, privacy, and legal counterparts to develop, review, and amend global cybersecurity policies and standards 
• Staying up-to-date on current cybersecurity threats, vulnerabilities, trends, and best practices to proactively evolve the cybersecurity risk and controls program 
• Communicating with technical and non-technical stakeholders and leaders on cybersecurity risk and controls management topics and program-specific reporting

What you’ll need to be successful in the role

• 8+ years of supporting and leading cybersecurity risk, controls, and policy management programs with familiarity with cybersecurity frameworks including ISO 27001, PCI-DSS, SOC, NIST CSF and regulatory requirements.
• Experience drafting and revising global cybersecurity policies and standards.  Experience collaborating closely with security partners, including incident response, red teams, architects, and engineers to seamlessly incorporate cybersecurity controls and risk management processes into their day-to-day operations
• Team player and motivated self-starter who is resourceful and has the ability to work collaboratively with multiple stakeholders across different products, business lines, and regions
• Excellent written communication skills with the ability to document, communicate, and report on cybersecurity risks as well as the status of the implementation and effectiveness of cybersecurity controls with product and business leaders
• Excellent verbal communication skills with the ability to translate complex technical concepts into business language
• Strong task management skills with the ability to support security risk and control projects and initiatives on time with multiple stakeholders
• Familiarity with Information Privacy regulations such as GDPR, CCPA, APPI, DORA etc.
• Familiarity with GRC technologies such as RSA Archer, Vanta, OneTrust or ServiceNow etc. 
• Desirable certifications include CISM, CISA, CISSP, CCSP, CASP, Security+, CRISC, CGEIT, GSEC, or other relevant certifications