Accountabilities:

Lead security governance, risk, and compliance activities across newly acquired companies, ensuring their control environments are progressively integrated into the organization's enterprise security framework.
Conduct security assessments during the acquisition due diligence process, where timelines allow, or immediately following transaction completion.
Evaluate each acquired company's security posture, including its control environment, identity and access management, infrastructure, third-party dependencies, and previous audit or regulatory examination history.
Prepare comprehensive security assessments against established security baselines, distinguishing between risks that may affect the transaction and those requiring long-term operational remediation.
Collaborate with M&A Technology teams and deal stakeholders to communicate security findings, identify integration requirements, and estimate the resources needed to address control deficiencies.
Map existing controls within acquired entities to internal security frameworks and applicable external standards, identifying gaps, overlaps, and opportunities for alignment.
Determine which existing organizational policies and controls can be extended to acquired entities, which require specific adaptations, and where new policies or controls must be introduced.
Assess control maturity at the entity level, document supporting evidence, and establish realistic remediation plans based on the acquired organization's size, capabilities, and current maturity.
Define measurable remediation milestones, including clear deadlines, accountable owners, and expected risk reduction outcomes.
Prioritize remediation activities according to risk severity and potential business impact rather than simply following framework requirements or addressing the easiest gaps first.
Monitor remediation progress, maintain regular follow-up with control owners, and escalate overdue activities or significant risks to Security GRC leadership.
Prepare proposed risk acceptance decisions, documenting their rationale and compensating controls for leadership review and approval.
Maintain acquired-entity risks within the enterprise risk register and ensure accurate, up-to-date reporting.
Prepare acquired companies for inclusion in external audit scopes by coordinating evidence collection, documentation, and audit walkthrough support.
Serve as the primary Security GRC contact for acquired-company leadership, finance teams, internal auditors, and other relevant stakeholders.
Develop and maintain entity-specific policy libraries where existing corporate policies do not adequately address local requirements or operational circumstances.
Coordinate the integration of third-party providers and vendors into established security governance and compliance processes.
Manage the transition of acquired entities to centralized GRC coverage once their control maturity reaches the required level, ensuring all handover activities are properly documented.
Develop standardized onboarding procedures and reusable documentation to make the acquisition integration process repeatable and scalable.
Identify recurring security and compliance findings and incorporate lessons learned into future acquisition due diligence activities.

Requirements

At least 5–7 years of professional experience in security governance, IT risk management, or regulatory compliance, preferably within regulated financial services, fintech, or virtual asset environments.
Direct experience integrating an acquired company into an existing security controls, governance, or compliance program. This is a core requirement for the position.
Working knowledge of SOX and Internal Control over Financial Reporting (ICFR) IT General Controls (ITGCs), including an understanding of external audit evidence requirements.
Practical experience with at least two of the following security and compliance frameworks: ISO 27001, SOC 1, SOC 2, and PCI DSS.
Strong understanding of control mapping across multiple regulatory and security frameworks, including the ability to identify gaps and establish appropriate control alignment.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1