Director of Security

Director of Security | VC-backed fintech | New York, NY

A fast-growing, venture-backed fintech is hiring its first Director of Security to own the security programme end to end. It has just closed its Series C and is scaling its engineering team and partner bank relationships, so security now sits at the centre of how the business grows.

This is a builder’s role. You’ll set the strategy, do a meaningful share of the hands-on work yourself at first, and hire the team around you as the programme matures. You’ll work closely with engineering, compliance and the executive team.

What you’ll own

• Programme leadership: define the security roadmap, risk register and policies, and report on security posture to leadership and the board.
• Regulatory and partner readiness: lead SOC 2 and PCI DSS, plus NYDFS Part 500 where it applies. Answer the security diligence that partner banks, card networks and enterprise customers bring.
• Cloud and product security: secure cloud infrastructure, CI/CD and the SDLC, embedding guardrails engineers actually adopt rather than gates they work around.
• Identity and access: own IAM across the workforce and production, including privileged access to money-movement systems and machine identities.
• Detection and response: build logging, detection and incident response capability, and lead response when it matters.
• Third-party risk: run vendor and sub-processor risk across a growing stack of financial and SaaS partners.
• Team building: hire and develop the first security engineers as the company scales.

What you’ll bring

• 8+ years in security, including time leading a programme or function at a high-growth technology company.
• Experience in financial services or another regulated environment, with first-hand exposure to audits, examiners or bank partner diligence.
• Hands-on technical depth across AWS or GCP security, identity and application security. You can review an architecture diagram and still get into the weeds.
• A track record of building programmes from early stage, not only running mature ones.
• Clear communication with engineers, executives and external auditors alike.

Nice to have

• Experience securing payments, card issuing, lending or digital-asset infrastructure.
• Familiarity with fraud and abuse risk alongside traditional security.
• Experience securing AI or agentic features in production.

If this sounds like you, get in touch.

View email address on click.appcast.io

View phone number on click.appcast.io