Head of Information Technology & Cybersecurity Audit

Chief Technology Officer — uSmart Capital

Broker-Dealer | Regulatory Examination & Technology Audit Accountability

uSmart Capital is seeking a Chief Technology Officer to own the technology function of a FINRA member firm registered with the SEC. This role is defined as much by regulatory accountability as by engineering leadership.

S. broker-dealer, technology is not merely subject to regulation — technology is the compliance record. Order handling, books and records, CAT reporting, pre-trade risk controls, communications retention, and customer data protection all live in systems the CTO owns. When FINRA issues an 8210 request, when the SEC Division of Examinations opens a cycle exam, when the independent accountant tests IT general controls, or when a deficiency letter lands, the CTO is the person who must produce the evidence, explain the control, and close the gap.

Regulatory Examination & Response

Act as the firm's principal technology interface to FINRA, the SEC, and other U.Own the technology side of regulatory production: data extraction, completeness and accuracy attestation, chain of custody, privilege coordination with Legal, and the ability to reproduce historical system state on demand

Own technology response to deficiency letters, exam findings, and any undertakings — including root cause, remediation plan with committed dates, interim compensating controls, and closure evidence

Own regulatory incident notification workflows for system disruptions, cybersecurity events, and customer data incidents, including Regulation S-P customer notification timelines and any applicable Form 8-K or Reg SCI obligations

Maintain a regulatory change pipeline covering SEC rulemaking, FINRA Regulatory Notices, and CAT technical specification updates; Own the technical architecture for SEC Rules 17a-3 and 17a-4 compliance: retention periods, non-rewriteable/non-erasable storage or the audit-trail alternative, indexing, legal hold, and the ability to furnish records promptly in examinable form

Own the technical reliability and accuracy of CAT (Consolidated Audit Trail) reporting: linkage, clock synchronization, error rate management, repair workflows, CAIS data protection, and reconciliation against internal order records

Own communications capture and archiving across all approved channels — email, chat, mobile, and client-facing messaging — and the technical controls that detect and prevent off-channel communications, an area of sustained enforcement focus

Ensure systems feeding net capital, customer reserve, and FOCUS reporting are controlled, reconciled, and auditable end to end, in partnership with the FinOp

Trading & Market Access Controls

Own the technical implementation and evidencing of SEC Rule 15c3-5 market access controls: pre-trade credit and capital thresholds, erroneous order controls, regulatory filter logic, kill switches, and documented annual review of control effectiveness

Own surveillance, order audit, and trade reconstruction capability sufficient to answer regulator questions about any order, any day

Own resilience and performance of order routing, execution, and market data infrastructure, including time synchronization to required tolerances

Own the firm's readiness for the annual audit by the PCAOB-registered independent accountant, including ITGC testing (access, change management, operations) and any compliance/exemption report support

Own internal audit and independent testing of technology controls under FINRA Rules 3110 and 3120, and supply the technology inputs supporting annual supervisory control and CEO certification processes

Maintain a documented, evidence-backed IT control framework mapped to applicable rules and to a recognized standard (NIST CSF, SOC 2, ISO 27001) — with control owners, testing cadence, and retained evidence

Commission and act on penetration testing, red teaming, code review, cloud configuration assessment, and third-party risk reviews; track findings to closure with risk-accepted exceptions formally approved

Report technology risk, examination status, audit findings, and remediation progress to the CEO, the Board, and relevant committees

Cybersecurity, Privacy & Vendor Governance

Own the information security program and incident response program required under Regulation S-P (safeguards and disposal), including the 2024 incident response and customer notification requirements

Own Regulation S-ID identity theft red flags detection controls and customer authentication architecture

Own third-party and outsourcing governance consistent with FINRA's vendor management expectations: due diligence, contractual audit rights, SOC report review, concentration risk, offshore access controls, and exit planning

Own data governance across jurisdictions, including controls over access to U.S. customer data by non-U.Where applicable, own compliance with state-level requirements such as NYDFS Part 500 and state data breach statutes

Platform, Resilience & Delivery

Own architecture and reliability strategy for the trading platform: high availability, disaster recovery, multi-region design, and low-latency performance

Own business continuity and DR under FINRA Rule 4370: documented plan, annual review, tested failover with evidenced results, and emergency contact reporting

Lead major incident command (P0/P1), postmortems, regulatory notification, and tracked remediation

Set technical direction for cloud (AWS ), Kubernetes maturity, observability (Zabbix ), core components (MySQL), and network/perimeter security (Cisco)

Own capacity planning and stress testing for market-wide volatility events, with documented and repeatable methodology

Build and mentor engineering, SRE/infrastructure, security, and DevOps teams; Own technology budget and vendor spend, and defend both at Board level

Partner with Compliance, Legal, Risk, Operations, and the business so that regulatory obligations and product roadmap advance together

Bachelor's degree or above in Computer Science, Engineering, or a related field

• 5+ years in technology, with 3+ years leading technology organizations at a U.S. registered broker-dealer, exchange, ATS, or comparable regulated financial institution
• Demonstrated experience owning the technology side of FINRA and/or SEC examinations — responding to 8210 requests, producing data under regulatory deadlines, and closing deficiency findings
• Working command of the rules that shape broker-dealer technology: Experience supporting annual independent audits and ITGC testing; AWS (EC2, VPC, ELB/ALB, RDS), Kubernetes in production, MySQL HA and tuning, Nginx and high-throughput systems, observability stacks, networking fundamentals
• willingness to obtain applicable principal registrations (e.g., Experience with low-latency trading, order routing, or market data infrastructure strongly preferred
• Professional fluency in English; Chinese (Mandarin) strongly preferred for group collaboration

#