White-Hat Hacker / Fractional CISO Wanted

Job Description

About the opportunity

VERU 365 is an early-stage startup building a 24/7 AI-powered financial co-pilot that banks and wealth firms offer to their clients under their own name. Banks will ask us hard questions about security, architecture and controls before they let us near their clients. We want an experienced security leader on our side who has answered those questions before: someone who reviews what we build, signs off on what we tell banks, and joins the call when a bank’s CISO or vendor-risk team wants to know how it works.

What you’ll do

In your first weeks, learn our system quickly enough to join bank security calls, using whatever tools help you get there.

Review our multi-tenant architecture on Google Cloud (Cloud Run, Cloud SQL Postgres with pgvector, Vertex AI, IAM, Cloud Armor), our identity provider and our data aggregation, and tell us plainly what a bank will push back on.

Check how we keep each bank’s data apart: per-tenant isolation in the database, in search over documents, and in every call we make to an AI model.

Advise on authentication, authorization and IAM for a B2B product where each bank administers its own users.

Lead our SOC 2 work through to the audit. Our policies and control matrix are drafted; you put the gaps in order, help choose the auditor, and keep us honest about what is not done.

Join bank and partner calls when security comes up: due-diligence questionnaires, penetration test findings, architecture reviews.

Review security-relevant changes before release, and our incident process if something goes wrong.

Help us answer bank vendor-management questionnaires accurately, including saying “not yet” where that is the truth.

You’re a fit if

If you are a true white-hat hacker and not just a figure-head CISO.

You have been a CISO, security architect or security lead at a bank, a fintech, or a vendor that sells to banks.

You have designed or reviewed multi-tenant SaaS on Google Cloud, with strong data isolation between customers.

You hold one or more Google Cloud certifications, such as Professional Cloud Security Engineer or Professional Cloud Architect.

You can explain a risk to a bank CEO and a fix to an engineer in the same meeting.

You can give a few hours a week reliably, and more in the weeks before an audit or a large bank meeting.

Nice to have

Experience with the FFIEC guidance and the 2023 interagency guidance on third-party risk.

Experience securing AI applications: prompt injection, data leakage between tenants, model vendor risk.

CISSP, CISM or CCSP.

An existing network among community bank and credit union security officers.

Experience taking a company through SOC 2 (Type I and Type II), and you know what bank vendor-risk teams and examiners ask for.