Chief Information Security Officer, CISO

This is a fully remote position, open to applicants in California, +1 more state.

📋 Description

• Establish RFA’s security strategy and oversee the GRC, SOC, and vCISO teams.

• Develop and manage RFA’s client security services, which include vCISO, managed detection and response, SOC, vulnerability management, email security, and incident response.

• Provide guidance to client CFOs, COOs, and CCOs regarding board and investment committee updates, regulatory compliance, and investor due diligence questionnaires (DDQs).

• Direct incident response efforts for RFA clients from the initial alert to client communication and post-incident analysis.

• Oversee RFA’s security and compliance initiatives, encompassing SOC 2 and client security assessments.

• Collaborate with Titan engineers to ensure the security of AI agents in client environments through the implementation of least-privilege access, guardrails, logging, and audit trails.

• Assist clients in the adoption of AI technologies like Claude, ChatGPT, and Copilot by guiding them on AI governance, data boundaries, connector and permission evaluation, and shadow AI identification.

• Engage in sales processes as RFA’s security representative, transforming client insights into packaged services and pricing structures.

• Report directly to RFA’s COO and work closely with RFA service delivery and engineering teams as well as Titan product and engineering teams.

• Evaluate success through client security outcomes, growth and retention of security revenue, and effective completion of client security reviews.

⛳️ Requirements

• A minimum of 10 years in the security field, including leadership roles such as CISO, VP, or Head of Security.

• Proven experience in building or managing security services at an MSP, MSSP, or security consultancy, preferably within financial services.

• Understanding of the security requirements for hedge funds, private equity firms, and asset managers, including knowledge of SEC cybersecurity regulations, Reg S-P, investor DDQs, NIST CSF, SOC 2, and ISO 27001.

• Practical experience with Microsoft 365, Entra ID, Intune, Defender, modern EDR, SIEM, and email security solutions.

• Capability to formulate safe practices for AI agents performing security-related tasks.

• Proficiency in articulating risk to fund COOs in straightforward terms and to engineers in detailed technical language.

• Possession of CISSP, CISM, CISA, or CRISC certifications (preferable).

• Experience as a vCISO for multiple clients within the financial services sector (preferable).

• Background in securing LLM applications or AI governance work, such as ISO/IEC 42001 or NIST AI RMF (preferable).

🏝️ Benefits

• Travel commitments are under 5% for occasional client meetings and team interactions in NYC.