Head of Information Security & IT

Yieldstreet•New York, NY

7h•$215,000 - $230,000•Onsite

About The Position

Willow Wealth is hiring a Head of Information Security & IT to lead the company’s information security and IT functions. Based in the New York City office, the role reports to the General Counsel and owns the firm’s cyber risk, IT systems and vendors for offices in New York and abroad, and security posture reporting to the board. The role also serves as the firm’s designated information security official. This is a hands-on leadership position at a growing company. The successful candidate will initially lead the IT team and managed security providers directly, then build out both functions as the company grows. The role works closely with Engineering, Legal, Compliance, and the executive team.

Requirements

Bachelor’s degree or equivalent experience.
At least 7 years of experience in information security and IT, including several years leading both functions at a financially regulated firm such as a broker-dealer, RIA, bank, or fintech.
Track record of leading real security incidents end to end, including notification decisions.
Experience reporting security posture to a board or executive committee in clear, plain language.
Hands-on experience with the listed platforms, especially cloud, identity, endpoint, and data loss prevention.
Experience running IT hands-on with a small team and managing vendors, with the drive to build out the function.

Nice To Haves

CISSP, CISM, or a cloud security certification.
Experience leading a SOC 2 audit or selecting a managed detection and response provider.
Experience supporting offices outside the US.

Responsibilities

Own the security program, policies, and cyber risk, and keep the firm exam- and audit-ready under SEC and FINRA expectations, including Regulation S-P and S-ID.
Report security posture to the board quarterly and to leadership monthly.
Lead incident response end to end, including notification decisions with Legal and Compliance, and run an annual tabletop exercise with the executive team.
Oversee vulnerability management, including continuous automated penetration testing, with remediation SLAs by severity.
Run IT hands-on with the IT team and set IT and A/V strategy, standards, and budget across offices in New York and abroad.
Partner with Engineering on application security, setting the standard and verifying it is met.
Own IT and security stacks, vendors, contracts, and renewals, and run security reviews for new and critical vendors.
Oversee core platforms and their security layers: AWS for the investor platform; Microsoft Azure and Microsoft 365 for corporate IT; identity and Zero Trust access; device management; managed detection and response; data loss prevention; email and web protection; application security scanning; and account takeover protection.
Build out the information security and IT functions as the company grows.