Senior Security Engineer GRC APAC Fintech and Financial Services

You will lead and improve the information-security GRC program supporting Japanese financial services and payments. You will automate compliance controls and evidence collection, embed regulatory requirements into technical designs, manage security risks and assessments, and work with auditors and internal stakeholders on Japan-specific regulatory readiness.

Responsibilities

• Own and evolve compliance for Japanese financial services and payments, including JFSA expectations, APPI, and local banking and payments controls.
• Build Compliance-as-Code capabilities, including policy-as-code, automated control validation, continuous evidence collection, and CI/CD monitoring.
• Operate and extend GRC platforms such as Vanta for control mapping, evidence management, and continuous compliance.
• Integrate GRC platforms with cloud, identity, logging, and engineering systems.
• Partner with architects and engineering leads to embed JFSA and APPI requirements into technical designs.
• Design, implement, and validate technical controls for access, logging, encryption, change management, vulnerability management, business continuity, disaster recovery, and secure SDLC.
• Operate the cybersecurity and compliance risk register and track meaningful business and regulatory risks.
• Lead risk assessments and compliance reviews for products, payment flows, vendors, and architectural changes.
• Coordinate with Legal and Data Privacy on APPI security measures and incident reporting.
• Manage relationships with external auditors, assessors, and JFSA supervisory contacts.
• Develop and improve policies, standards, and procedures aligned with Japanese financial-services requirements.

Requirements

• Bachelor's degree in computer science, information security, cybersecurity, risk management, engineering, STEM, or equivalent practical experience.
• 8+ years of experience operating a GRC, information-security compliance, or ISMS program in regulated technology environments with primary Japan exposure.
• Experience operating an ISMS and control library and supporting security assurance, audits, or regulatory evidence processes.
• Hands-on experience with JFSA expectations and Japanese banking and payments technology controls.
• Knowledge of information-security risk management, control assessment, risk treatment, and governance reporting.
• Experience coordinating incident-response governance and supplier or third-party security assurance.
• Working knowledge of APPI.
• Technical fluency with cloud platforms, identity, logging, secure SDLC, and control evaluation.
• Fluency in English.
• Based in Japan.