Cyber & AI Risk Analyst
Alpaca is a brokerage infrastructure company providing developer APIs for stocks, options, fixed income, and crypto trading, plus tokenization infrastructure for TradFi–DeFi markets.
Funding history
Investors
About Alpaca
Alpaca provides API-first brokerage infrastructure for fintechs, institutions, algorithmic traders, and developers. Its offerings include Broker API, Trading API, market data, self-clearing brokerage services, crypto services, and the Instant Tokenization Network for in-kind minting and redemption of tokenized assets.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will strengthen security, compliance and AI risk posture, reporting to the Cyber GRC Lead. You will assess cyber and AI risks across infrastructure, products and trading systems, help build AI governance controls, and collaborate with Engineering, Product, Legal, Compliance and IT teams. Prior GRC experience is a plus but not required.
Requirements
- 1+ years of experience in cybersecurity, risk management, IT audit, GRC or related field (internships, coursework or equivalent welcome)
- Foundational understanding of cybersecurity principles
- Familiarity with NIST CSF, ISO 27001, SOC 2 or similar
- Understanding of AI/ML concepts and risks
- Strong written communication and documentation skills
- Ability to communicate technical risks to non-technical stakeholders
- Experience working cross-functionally with engineering and product teams
- Highly organized with attention to detail
- Comfort in a fast-paced environment
- Curiosity about AI and comfort using AI tools daily
Responsibilities
- Support execution of the cybersecurity risk management program
- Conduct cyber risk assessments across cloud infrastructure, APIs, trading systems and internal platforms
- Identify, document and evaluate AI-related risks
- Help develop and maintain AI governance controls aligned with regulations such as the EU AI Act
- Perform third-party/vendor security and AI risk assessments
- Contribute to control testing across SOC 2, ISO 27001, CSA Star, NIST CSF and AI governance standards
- Track remediation and maintain risk registers and reporting dashboards
- Support internal and external audits with documentation and evidence
- Monitor regulatory developments in cybersecurity, financial services and AI governance
- Help mature policies, standards and procedures
- Support a repeatable AI tool/model evaluation process
- Support AI usage guidance and standards
- Help maintain AI logging/monitoring standards
- Use AI tools daily and help test AI-related controls
Benefits
- Stock options
- Health benefits
- New hire home-office setup: one-time USD $500
- Monthly stipend: USD $150 via a Brex Card
