Security GRC Analyst, Mergers & Acquisitions
Payward, Inc. is the parent company and operating platform behind Kraken and a portfolio spanning trading, custody, payments, lending, tokenized assets, onchain finance, and benchmarks.
Funding history
Investors
Projects
About Payward, Inc.
Payward operates unified financial infrastructure across crypto and traditional markets, including shared liquidity, risk and margin systems, collateral and settlement, compliance, and licensing. Its first-party portfolio includes Kraken, Kraken Pro, NinjaTrader, Breakout, xStocks, Payward Services, CF Benchmarks, Reap, Krak, Kraken Prime, Kraken OTC, Kraken Custody, and Bitnomial.
Skills
Candidate Availability
About the Role
You will own security governance, risk, and compliance for Payward's acquisitions. You will assess targets, map controls to frameworks, set achievable remediation milestones, track them to closure, maintain risk registers and policies, prepare entities for external audit, and document a repeatable onboarding process.
Requirements
- 5-7+ years in security governance, IT risk, or compliance in regulated financial services, fintech, or virtual asset environments
- Direct experience onboarding an acquired company into a controls or compliance program
- Working knowledge of SOX/ICFR IT general controls
- Experience with at least two of ISO 27001, SOC 1, SOC 2, and PCI DSS
- Ability to assess control maturity and set remediation plans
- Strong project management across distributed teams
- Ability to translate control gaps into risk language
Responsibilities
- Assess acquisition targets against the security baseline
- Map acquired controls to Payward and external frameworks
- Score control maturity at entity level
- Define and track remediation milestones
- Recommend full migration or uplift for each entity
- Load acquired-entity risks into the enterprise risk register
- Prepare entities for external audit including evidence collection
- Act as Security GRC point of contact for acquired-entity leadership
- Build entity-specific policy libraries
- Document a repeatable onboarding process
- Integrate third parties and vendors
Benefits
- Remote-first team
