Risk & Controls Manager, MetaMask

$150-206k

Salary applicable to U.S. - may vary in other locations

Mid, Senior and Expert level

Remote from Europe, UK, US

More information about location

Tools & infrastructure powering Ethereum

Open for applications

Tools & infrastructure powering Ethereum

501-1000 employees

FintechB2BCryptocurrencySaaSBlockchainWeb 3.0

Open for applications

$150-206k

Salary applicable to U.S. - may vary in other locations

Mid, Senior and Expert level

Remote from Europe, UK, US

More information about location

501-1000 employees

FintechB2BCryptocurrencySaaSBlockchainWeb 3.0

Company mission

MetaMask's mission is to make money open and build the operating system for Open Money - giving individuals direct, self-custodial control of their financial lives without relying on closed institutional intermediaries.

Job

Company

Role

Who you are

Hands-on experience running a risk register, control library and audit cycle (ISO 27001 and/or SOC 2)
Comfortable with GRC platforms (Drata or equivalent) and turning monitoring into evidence
Proven ability to coordinate audits and customer questionnaires with named control owners
Precise written work; register and Statement of Applicability quality matters
Strong stakeholder management with control owners and auditors
CISA, ISO 27001 Lead Implementer or Auditor, or equivalent professional certification
Don't meet all the requirements? Don't sweat it. We’re passionate about building a diverse team of humans and as such, if you think you've got what it takes for our chaotic-but-fun, remote-friendly, start-up environment—apply anyway, detailing your relevant transferable skills in your cover letter. While we have a pretty good idea of what we need, we're ready for you to challenge our thinking on who needs to be in this role

What the job involves

This role runs the internal posture engine — the risk register, critical control monitoring, evidence, audit operations and GRC tooling. It keeps risk state current so the Lead and the Risk Committee decide from accurate data in the Risk Dashboard and reporting. Drata is the register of record. Named owners close gaps; this role keeps the register, evidence and audit operations current
Operate the risk register from the Security Programme threat model: populate, track treatment, record acceptance decisions, follow up owners, and run the exceptions register
Keep the ISMS and security policy library current as part of audit readiness. Draft security standards when commissioned by the Lead
Run Drata as the control and evidence system — Statement of Applicability, framework crosswalk and automation
Run critical control monitoring: health check-ins, drift flags and Drata automation. Route drift to the SOC. Maintain the evidence file for Lead assessments and independent internal audit
Feed threat-assessment findings into the register and confidence ratings. Track which required assessments are current
Lead audit coordination and preparation: ISO 27001 and SOC 2 logistics, ISMS readiness, team prep, management-review pack, and customer due-diligence questionnaires
Coordinate the control register for external testing (red team, tabletop, pentest). Run security awareness and weekly alerts
Track residual risk, exceptions and gap-closure against appetite. Exceptions expire and are reported; the underlying requirement stays in force
Report register state and evidence health so the Lead and Risk Committee work from one view
Be accountable for a current, defensible posture engine — register, evidence and audit operations
Ensure Drata collects evidence continuously, with automated evidence where coverage exists

Application process

It is a requirement of employment in this position that applicants may be required to submit to background and identity verification checks, including but not limited to employment, education, criminal record checks, and other such checks as determined necessary by the company

Our take

Stablecoins are now worth around $300 billion , even after the market shrank for the first time in four years . As digital dollars become a regular part of how people spend and save, the bigger contest is over who becomes their everyday front door to that money.

MetaMask is one of the most widely used self-custodial crypto wallets. It lets people hold, trade and use digital assets themselves, without a bank or exchange holding the money for them. The wallet has more than 100 million downloads across roughly 190 countries , and it's growing into payments, savings and investing . The company, formerly Consensys Software, now focuses only on this consumer business. Ethereum co-founder Joe Lubin runs it as chairman and CEO . In 2022, Microsoft, SoftBank and Temasek were among the backers of a $450 million round that valued the group at $7 billion.

The opportunity is real, and so is the volatility. Weak markets pushed back a possible IPO , and regulators have challenged its products in the past . If MetaMask can win the trust of mainstream users, it has a real chance to become the default home for people who want to control their own money.

Steph

Company Specialist at Welcome to the Jungle

Insights

Top investors

-10% employee growth in 12 months

Glassdoor (3)

Company

Funding (last 2 of 4 rounds)

Mar 2022

$450m

SERIES D

Nov 2021

$200m

LATE VC

Total funding: $725m

Company HQ

East Williamsburg, NY

Leadership

Joseph Lubin

(CEO & Founder)

Formerly President of SynerG Music and Director of New York Office for Blacksmith Technologies. Currently Co-Founder of Ethereum.

Share this job

View 3 more jobs at MetaMask