Director of Security & Risk - SentiLink

SentiLink helps institutions protect customers by accurately resolving identities and flagging fraud risk. Each day, we verify more than 3 million identities, flagging 150k+ fraud attempts in the process. The problems we work on are challenging, and solving them takes deep domain expertise, rigorous analysis, and a willingness to dig into the details.

At SentiLink, you'll work alongside smart, highly collaborative colleagues who respect each other's time and judgment, take ownership, and follow through on their commitments. Together, we do truly meaningful work protecting the identities of innocent consumers and flagging the fraudsters attempting to exploit them.

We're well capitalized and growing quickly. We serve top U.S. banks, are expanding into new markets, and are backed by Craft Ventures, Andreessen Horowitz, NYCA, and Max Levchin.

About the Role

SentiLink's Information Security team is responsible for protecting our systems, data, and customers while enabling the business to operate securely and efficiently. We work closely with Engineering, IT, Legal, Product, and business teams to manage security risks, maintain regulatory compliance, and build effective security controls across the organization.

We're looking for a Director of Security & Risk to lead our security governance, compliance, assurance, and risk management programs. This is a leadership role with broad ownership across FedRAMP, SOC 2, PCI DSS, customer and partner security assessments, third-party risk, and security policy.

SentiLink operates a highly technical, AWS-based environment, and many of the risks and compliance requirements we manage require deep technical understanding. You will lead and develop a team of security and compliance professionals, establish priorities, identify gaps in existing programs, and develop a roadmap for improving our security posture.

You will report to SentiLink's security leader and work closely with Security Engineering, which remains a separate function responsible for technical security architecture and implementation.

Key Responsibilities

• Lead & Develop Security GRC: Manage and mentor security and compliance professionals, evaluate program effectiveness, identify gaps in expertise/capacity, and build hiring plans as the company grows.
• Own Compliance & Audit Programs: Direct FedRAMP, SOC 2, and PCI DSS compliance programs. Lead external assessments, oversee control effectiveness and evidence collection via Vanta, and ensure continuous obligation readiness.
• Drive Government Security Maturity: Oversee FedRAMP continuous monitoring, POA&M governance, change-management compliance, agency-specific requirements, and assessment readiness (including FedRAMP 20x preparedness).
• Operate Security Risk Management: Establish risk management frameworks covering identification, assessment, documentation, escalation, and treatment of security risks, deficiencies, and exceptions.
• Lead Third-Party Risk Management: Establish and enforce risk-based vendor diligence requirements, improve assessment quality, and manage ongoing vendor oversight.
• Own Customer & Partner Assurance: Lead security assessments and audits from financial institutions and government partners. Partner with Legal to evaluate contractual security requirements and coordinate technical responses.
• Policy & Control Governance: Maintain security policies, standards, and control frameworks mapped across regulatory obligations and actual operations.
• Program Scalability & Improvement: Develop clear accountability, repeatable processes, and automation to continuously elevate security controls.

Requirements

• 10+ years of experience in information security, with substantial experience leading governance, compliance, assurance, or risk management programs.
• Demonstrated ownership of major compliance frameworks (FedRAMP, SOC 2, PCI DSS) and direct engagement with external auditors and regulators.
• Strong technical understanding of modern cloud infrastructure (AWS), SaaS application security, IAM, vulnerability management, and security architecture.
• Proven ability to build and mature security programs, identify control gaps, and establish strategic priorities.
• Track record of managing, mentoring, and building distributed security teams.
• Experience with third-party risk assessments, customer diligence, and complex contractual security requirements.
• Strong written and verbal communication skills with the ability to influence cross-functional teams and external stakeholders.

Compensation & Benefits

• Base Pay: $200,000 - $260,000 / year
• Equity compensation package
• Employer-paid group health insurance for you and your dependents
• 401(k) plan with employer match
• Flexible paid time off
• Home office stipend
• Regular company-wide in-person events