Sr. Security Engineer, GRC APAC Fintech & Financial Services

The role

You will own and grow the information security governance, risk and compliance program for Japan financial services and payments. You will build compliance-as-code, control validation and evidence collection, and work with engineering and external auditors and supervisors.

What you will do

• Own and evolve Japan financial services and payments compliance across JFSA expectations, APPI, and local banking and payments technology controls supporting X Money
• Build and maintain Compliance-as-Code: policy-as-code, automated control validation, continuous evidence collection, and CI/CD monitoring
• Operate and extend GRC platforms such as Vanta for control mapping, evidence management, and continuous compliance
• Partner with architects and engineering leads to design JFSA and APPI requirements into systems early
• Design, implement and validate technical controls for banking and payments environments
• Operate the cybersecurity and compliance risk register and assess risk for new products, vendors and architecture changes
• Lead risk assessments and compliance reviews, including third-party technology risk and sub-processor oversight
• Work with Legal and the Data Privacy team on APPI security intersections and incident reporting
• Manage relationships with external auditors, assessors and JFSA supervisory contacts
• Develop and maintain policies and procedures mapped to a control library shared with US Fintech

Required qualifications

• Bachelor's degree in computer science, information security, cybersecurity, risk management, or an engineering or STEM discipline
• 8+ years owning or materially operating a GRC, information security compliance or ISMS program in fintech, banking, payments, SaaS or other regulated technology with primary Japan exposure
• Professional fluency in English
• Must be based in Japan
• Full-time onsite role, five days a week in the office
• Must be willing to travel occasionally

Nice to have

• Experience owning or operating an ISMS and control library, and supporting client assurance, external audits or regulatory evidence
• Hands-on experience with JFSA expectations and local Japanese banking and payments technology controls
• Strong understanding of information security risk management and governance reporting
• Experience coordinating incident response governance and supplier security assurance
• Working knowledge of APPI
• Technical fluency with cloud (AWS, GCP, Azure), identity, logging and secure SDLC
• 10+ years of information security compliance, GRC engineering or technology audit experience in fintech or financial services with Japan focus
• Hands-on implementation of technical controls and CI/CD or DevSecOps compliance checks
• Familiarity with threat modeling, SAST/DAST, dependency scanning, secrets management and penetration testing
• Experience with trust centers, vendor questionnaires and client security schedules for Japan clients

Before you apply

• Must be based in Japan
• Must be willing to travel occasionally

About the company

SpaceXSI is building Super Intelligence, including Colossus supercomputers, Grok models and applications such as Grok Bot, Grok Build, Grok Imagine, Grok Voice and X. It is an equal opportunity employer.