Security GRC Analyst, Mergers & Acquisitions

Payward, the parent company behind Kraken, is seeking a Security GRC Analyst to own security governance, risk, and compliance across its acquisitions. This is a critical role responsible for integrating acquired companies into Payward's existing control environment, from initial diligence through to full platform migration or ongoing central program coverage.

Payward operates in a dynamic M&A landscape, acquiring companies across various jurisdictions and regulatory regimes. Each acquisition presents unique challenges with its own control environment, maturity level, and audit history. This role is designed to provide dedicated ownership for the security integration process, ensuring a repeatable and effective approach.

Responsibilities:

• Target Assessment:
  • Assess acquisition targets against Payward's security baseline during diligence and immediately post-close.
  • Review target security posture, including control environment, identity and access management, infrastructure, third-party dependencies, and prior audit history.
  • Produce written assessments detailing security risks relevant to both deal-specific and steady-state operations.
  • Provide clear insights to the M&A Technology Team and deal sponsors regarding the control remediation costs associated with integration.
• Control Mapping and Framework Onboarding:
  • Map acquired company controls to Payward's framework and relevant external frameworks.
  • Identify existing parent company controls that extend to the entity, determine needs for entity-specific variants, and flag areas with no equivalent.
  • Develop entity-specific policy libraries where the parent policy set is not directly applicable.
• Remediation and Milestones:
  • Define achievable remediation milestones with clear dates, owners, and stated risk reduction goals.
  • Prioritize remediation efforts based on risk reduction rather than framework order.
  • Track remediation progress, escalate overdue or material risks, and prepare proposed risk acceptances for leadership review.
• Program Integration:
  • Prepare acquired entities for external audit inclusion and provide fieldwork support.
  • Maintain visibility of acquired entity risks in the enterprise risk register and Security GRC reporting.
  • Facilitate the handover of entities to central GRC coverage once their maturity is sufficient, ensuring proper documentation.
  • Integrate third-party vendors into Payward's security framework.

Qualifications:

• 5-7+ years of experience in security governance, IT risk, or compliance, preferably within regulated financial services, fintech, or virtual asset environments.
• Direct experience onboarding an acquired company into an existing controls or compliance program is essential.
• Working knowledge of SOX/ICFR IT general controls and auditor evidence requirements.
• Experience with at least two of the following frameworks: ISO 27001, SOC 1, SOC 2, and PCI DSS, including cross-framework control mapping.
• Ability to assess control maturity and establish realistic remediation plans for teams with varying maturity levels.
• Hands-on approach to delivery, including scope definition, evidence collection, and gap closure.
• Strong judgment for prioritizing tasks with incomplete information and escalating critical decisions.
• Proven ability to build collaborative relationships with control owners in IAM, infrastructure, and engineering.
• Skill in translating control gaps into actionable risk language for deal teams and executives.
• Excellent project management skills for cross-functional, distributed teams.

Preferred Qualifications:

• CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer certification.
• Experience with M&A or post-merger technology integration.
• Familiarity with PKM.

Why This Role:

• Ownership: You will own a critical domain end-to-end, establishing processes where none currently exist.
• Impact: Security integration is a key component of Payward's rapid acquisition strategy.
• Visibility: Work directly with deal teams, acquired leadership, external auditors, and Security GRC leadership.
• Growth: Contribute to building the controls necessary for Payward's preparation for public company reporting.
• Scope: The role's scope will expand with the acquisition pipeline across diverse jurisdictions and regulatory environments.
• Culture: Join a remote-first, international team.

Payward is committed to building a diverse and inclusive workforce. We encourage applications from candidates who may not meet every listed requirement but are passionate about crypto and possess relevant skills.