Security GRC Analyst – Mergers & Acquisitions

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of security governance, risk management, and compliance for Payward's acquisitions.

• Evaluate acquisition candidates against Payward's security baseline during the due diligence phase or right after the deal closes.

• Analyze target control environments, identity and access management (IAM), infrastructure, third-party dependencies, and audit history.

• Align the controls of the acquired company with Payward's framework and relevant external standards.

• Assess the maturity of entity-level controls and document the rationale for scoring.

• Identify any control deficiencies and establish risk-prioritized remediation milestones, including deadlines, responsible parties, and anticipated risk reduction.

• Monitor remediation efforts until completion and escalate any overdue or significant risks.

• Prepare proposed risk acceptances with justifications and compensating controls for leadership review.

• Suggest either a complete platform migration or a maturity endpoint that the central program can accommodate.

• Enter acquired-entity risks into the enterprise risk register and keep them updated.

• Ready acquired entities for external audit scope, including evidence gathering, walkthroughs, and fieldwork support.

• Act as the Security GRC point of contact for leadership, finance, and internal audit of acquired entities.

• Develop entity-specific policy libraries where applicable parent policies do not exist.

• Incorporate recurring findings into future acquisition due diligence.

• Document a standardized acquisition onboarding process.

• Integrate third parties and vendors into Payward's operations.

• Transition entities to central GRC coverage with a documented handover process.

• Collaborate with M&A Technology, deal sponsors, control owners, external auditors, and Security GRC leadership.

⛳️ Requirements

• 5–7+ years of experience in security governance, IT risk, or compliance, particularly within regulated financial services, fintech, or virtual asset sectors.

• Direct experience in integrating an acquired company into an existing controls or compliance framework.

• Proficient understanding of SOX/ICFR IT general controls and requirements for external audit evidence.

• Experience with at least two of ISO 27001, SOC 1, SOC 2, and PCI DSS, including the mapping of controls across different frameworks.

• Capability to evaluate control maturity and formulate remediation plans for teams below Payward's maturity threshold.

• Hands-on ability to define project scope, gather evidence, and address gaps.

• Strong judgment regarding priorities with incomplete information, along with the ability to escalate decisions to leadership.

• Proficient in building collaborative relationships with control owners in IAM, infrastructure, and engineering.

• Ability to translate control deficiencies into actionable risk language.

• Excellent project management skills across cross-functional and distributed teams.

• Preferred: CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer certifications.

• Preferred: Experience in M&A or post-merger technology integration.

• Preferred: Familiarity with PKM.

• Applicants must specify the city and country from which they will be working.

• Applicants must indicate whether they require work sponsorship in their location.

🏝️ Benefits

• Equity program.

• Bonus program.

• Wellness allowance.

• Medical benefits.

• Dental benefits.

• Vision benefits.

• 401(k) plan.

• Remote-first work environment.

• International team.

• Continuous application acceptance when no deadline is specified.

• Equal opportunity employment.

• Job-related skills or work-style assessments applied uniformly across candidates.

• Participation in dogfooding Kraken products is mandatory after joining.