Senior Security Compliance Manager, SoFi

• BS degree in Computer Information Systems or related field
• 7+ years of experience with security GRC initiatives Experience with regulatory cybersecurity compliance examinations
• Substantive and current knowledge of transaction banking compliance, consumer and commercial lending, deposit, wires, cards and privacy regulations applicable to banks
• Experience with onboarding and monitoring cybersecurity controls in cloud environments specifically AWS
• Experience with AI governance and risk assessments using frameworks like NIST AI RMF, ISO42001, ISO 38507 and other privacy regulations like CCPA, GDPR etc
• Strong knowledge of security risk management and running audits/certification programs
• Self-starter with strong interpersonal and communication skills
• Demonstrate ability to assimilate new knowledge quickly
• Comfortable working in a fast-paced, dynamic environment, and managing multiple projects concurrently
• Experience with managing programs in GRC tools

Desirable

• The Technology and Cybersecurity risk and controls team handles a wide range of cross-functional activities, from security compliance certifications and audits, to risk management, inbound and outbound due diligence, third party risk management, security awareness, policy and procedures, and more
• Each of these ongoing parallel activities entails interpreting and setting requirements, assessing the effectiveness of security controls, risk-based decision making, cross-functional collaboration and communication, and staying up-to-date on security best practices and how changes in the evolving threat landscape need to inform our strategy
• We are seeking an experienced Security Compliance Manager responsible for monitoring and governing security controls in the cloud based on regulatory/compliance requirements and industry standards for our core Banking platform
• Candidate must be able to assimilate knowledge quickly, understand stakeholder’s business challenges/risks, and act as a trusted advisor to lead change, policy adoption and monitor compliance against policies and standards
• Own bank compliance and controls testing, monitoring and issue management
• Manage ongoing investor audits like SOC2, PCI DSS, SOX ITGC, GLBA and security due diligence questionnaires
• Serve as the primary liaison between internal stakeholders (i.e. Cybersecurity,
• Technology, Product, Risk, Privacy, Internal Audit, HR, Legal, Sales etc…) and external auditors, regulators, and third-party assessors
• Monitor compliance with cybersecurity policies and standards and assess security compliance risks for bank scoped products, processes and technologies in a cloud environment
• Partner with stakeholders to conduct walkthroughs and create process maps for critical cybersecurity processes, facilitating in risk and control identification and ensure the environment is operating safely and in control
• Translate technical controls and requirements into audit-ready evidence, and work with technical teams to align implementations with compliance expectations
• Support regulatory, third party attestation, and Internal Audit, audit readiness activities, ensuring control design and execution meet internal policy and external regulatory standards
• Communicate clearly and effectively with both technical and non-technical audiences, including executives, control owners, and external assessors