Chief Technology Officer

Chief Technology Officer uSmart CapitalBroker-Dealer | Regulatory Examination & Technology Audit Accountability1. OverviewuSmart Capital is seeking a Chief Technology Officer to own the technology function of a FINRA member firm registered with the SEC. This role is defined as much by regulatory accountability as by engineering leadership.In a U.S. broker-dealer, technology is not merely subject to regulation technology is the compliance record. Order handling, books and records, CAT reporting, pre-trade risk controls, communications retention, and customer data protection all live in systems the CTO owns. When FINRA issues an 8210 request, when the SEC Division of Examinations opens a cycle exam, when the independent accountant tests IT general controls, or when a deficiency letter lands, the CTO is the person who must produce the evidence, explain the control, and close the gap.We are looking for someone who has done this not someone who will learn it here.2. Core ResponsibilitiesRegulatory Examination & ResponseAct as the firm's principal technology interface to FINRA, the SEC, and other U.S. regulators; own preparation for and response to cycle examinations, for-cause exams, sweep letters, and Rule 8210 information requestsOwn the technology side of regulatory production: data extraction, completeness and accuracy attestation, chain of custody, privilege coordination with Legal, and the ability to reproduce historical system state on demandOwn technology response to deficiency letters, exam findings, and any undertakings including root cause, remediation plan with committed dates, interim compensating controls, and closure evidenceOwn regulatory incident notification workflows for system disruptions, cybersecurity events, and customer data incidents, including Regulation S-P customer notification timelines and any applicable Form 8-K or Reg SCI obligationsMaintain a regulatory change pipeline covering SEC rulemaking, FINRA Regulatory Notices, and CAT technical specification updates; assess technical impact and deliver ahead of compliance datesBooks, Records & Reporting IntegrityOwn the technical architecture for SEC Rules 17a-3 and 17a-4 compliance: retention periods, non-rewriteable/non-erasable storage or the audit-trail alternative, indexing, legal hold, and the ability to furnish records promptly in examinable formOwn the required undertakings and third-party arrangements associated with electronic recordkeeping (including designated executive officer and third-party access undertakings where applicable)Own the technical reliability and accuracy of CAT (Consolidated Audit Trail) reporting: linkage, clock synchronization, error rate management, repair workflows, CAIS data protection, and reconciliation against internal order recordsOwn communications capture and archiving across all approved channels email, chat, mobile, and client-facing messaging and the technical controls that detect and prevent off-channel communications, an area of sustained enforcement focusEnsure systems feeding net capital, customer reserve, and FOCUS reporting are controlled, reconciled, and auditable end to end, in partnership with the FinOpTrading & Market Access ControlsOwn the technical implementation and evidencing of SEC Rule 15c3-5 market access controls: pre-trade credit and capital thresholds, erroneous order controls, regulatory filter logic, kill switches, and documented annual review of control effectivenessOwn surveillance, order audit, and trade reconstruction capability sufficient to answer regulator questions about any order, any dayOwn resilience and performance of order routing, execution, and market data infrastructure, including time synchronization to required tolerancesAudit & Independent AssuranceOwn the firm's readiness for the annual audit by the PCAOB-registered independent accountant, including ITGC testing (access, change management, operations) and any compliance/exemption report supportOwn internal audit and independent testing of technology controls under FINRA Rules 3110 and 3120, and supply the technology inputs supporting annual supervisory control and CEO certification processesMaintain a documented, evidence-backed IT control framework mapped to applicable rules and to a recognized standard (NIST CSF, SOC 2, ISO 27001) with control owners, testing cadence, and retained evidenceCommission and act on penetration testing, red teaming, code review, cloud configuration assessment, and third-party risk reviews; track findings to closure with risk-accepted exceptions formally approvedReport technology risk, examination status, audit findings, and remediation progress to the CEO, the Board, and relevant committeesCybersecurity, Privacy & Vendor GovernanceOwn the information security program and incident response program required under Regulation S-P (safeguards and disposal), including the 2024 incident response and customer notification requirementsOwn Regulation S-ID identity theft red flags detection controls and customer authentication architectureOwn third-party and outsourcing governance consistent with FINRA's vendor management expectations: due diligence, contractual audit rights, SOC report review, concentration risk, offshore access controls, and exit planningOwn data governance across jurisdictions, including controls over access to U.S. customer data by non-U.S. affiliates and personnelWhere applicable, own compliance with state-level requirements such as NYDFS Part 500 and state data breach statutesPlatform, Resilience & DeliveryOwn architecture and reliability strategy for the trading platform: high availability, disaster recovery, multi-region design, and low-latency performanceOwn business continuity and DR under FINRA Rule 4370: documented plan, annual review, tested failover with evidenced results, and emergency contact reportingLead major incident command (P0/P1), postmortems, regulatory notification, and tracked remediationSet technical direction for cloud (AWS ), Kubernetes maturity, observability (Zabbix ), core components (MySQL), and network/perimeter security (Cisco)Own capacity planning and stress testing for market-wide volatility events, with documented and repeatable methodologyLeadershipBuild and mentor engineering, SRE/infrastructure, security, and DevOps teams; define hiring standards and succession plans that eliminate key-person dependencyOwn technology budget and vendor spend, and defend both at Board levelPartner with Compliance, Legal, Risk, Operations, and the business so that regulatory obligations and product roadmap advance together3. QualificationsBachelor's degree or above in Computer Science, Engineering, or a related field5+ years in technology, with 3+ years leading technology organizations at a U.S. registered broker-dealer, exchange, ATS, or comparable regulated financial institutionDemonstrated experience owning the technology side of FINRA and/or SEC examinations responding to 8210 requests, producing data under regulatory deadlines, and closing deficiency findingsWorking command of the rules that shape broker-dealer technology: SEC Rules 17a-3/17a-4, 15c3-5, Regulation S-P and S-ID, CAT reporting obligations, FINRA Rules 3110/3120/4370/4511, and communications retention requirementsExperience supporting annual independent audits and ITGC testing; familiarity with SOC 2, NIST CSF, or ISO 27001 control frameworksStrong hands-on architecture credibility: AWS (EC2, VPC, ELB/ALB, RDS), Kubernetes in production, MySQL HA and tuning, Nginx and high-throughput systems, observability stacks, networking fundamentalsAbility to satisfy FINRA fit-and-proper standards; willingness to obtain applicable principal registrations (e.g., Series 7/24) if the role's supervisory scope requiresExperience with low-latency trading, order routing, or market data infrastructure strongly preferredProfessional fluency in English; Chinese (Mandarin) strongly preferred for group collaboration
recblid qjtgtcpejbpvsv7al7o9wxxv76ksgp