Head of Information Security [ONSITE- BERWYN, PA]

Magis Capital Partners LL•Berwyn, PA

1d•$150,000 - $165,000•Onsite

About The Position

The Head of Information Security is FIDx’s senior security leader, responsible for defining and executing the company’s information security, data privacy, and cyber-risk strategy as the company grows. The role protects the platform, data, and reputation, including sensitive financial and personal data shared across integrations with carriers, advisors, and partners. It reports to the Chief Technology Officer and engages regularly with the CEO, executive team, and Board on risk and security posture. The position spans security governance, risk and compliance, security architecture, security operations, and incident response. It directs day-to-day security operations and implementation of security policies while balancing protection with the speed and agility of a growing fintech. Initially, this is a hands-on role operating the security function as a team of one; as the company scales, the role will build, hire, and lead a dedicated security team. The role builds and executes the security roadmap; embeds security across the software development lifecycle and product delivery; establishes security architecture and controls; operates risk, compliance, audit, vendor-risk, privacy, continuity, and incident-response programs; and reports on security posture to leadership. The position also promotes a security-conscious culture and serves as a trusted advisor across the company. The job operates in an office and professional environment, routinely using standard office equipment. Occasional field visits to vendors and partners are required. Travel is required up to 20% based on operational and business needs. This is a full-time, exempt position, primarily Monday through Friday, with schedule needs that may include weekends, nights, and early mornings, particularly for on-call security incident response.

Requirements

7–15 years of information security or cybersecurity experience, with a history of upward progression into senior leadership.
Bachelor’s degree in Computer Science, Information Security, or a related field.
Direct, hands-on experience building or running an enterprise information security program, ideally at an early-stage company, with execution across multiple security domains.
Strong background in cloud security, API security, secure SDLC / DevSecOps, and application or product security.
Demonstrated expertise with security frameworks and regulations relevant to financial services and insurance, such as SOC 2, NIST, ISO 27001, GLBA, and CCPA.
Proven experience leading incident response and managing security incidents through resolution.
Experience owning third-party and vendor risk in a heavily integrated platform environment.
Strong leadership skills and an entrepreneurial approach; able to operate hands-on as an initial team of one and build, hire, manage, and develop a security team as the function grows.
Experience with client-facing work and communicating with employees at all levels, board members, C-level executives, auditors, regulators, and partners.
Ability to translate complex security and risk concepts into clear business terms for diverse customers and employees.
Experience with change management, strategic vision implementation, and team development or leadership.
Highly collaborative and effective working with vendors, employees, leadership, board members, carriers, and other stakeholders.
Ability to participate as a member of the management team.
Strong decision-making and organizational skills; reliable, detail-oriented, and highly motivated.
Able to step into a fast-paced work environment.
Willingness to travel up to 20% based on operational and business needs.
Work schedule may require weekends, nights, and early mornings, including on-call incident response.

Nice To Haves

Financial services, insurance, fintech, and/or startup experience.
Master’s degree or MBA.
Industry security certifications such as CISSP, CISM, CRISC, CISA, or CCSP.

Responsibilities

Own and operate the firm’s information security program and serve as its primary subject matter expert on cybersecurity, data privacy, and information-security compliance.
Establish and continuously mature enterprise security policies, standards, and controls for approval by the CTO and executive team.
Assess security implications of new products, markets, and partnerships, and recommend secure approaches.
Build and execute the information security roadmap in alignment with the CTO and executive team.
Work with development and DevOps staff to embed secure-by-design principles, secure coding, code review, and dependency and supply-chain management into the SDLC.
Provide hands-on security guidance to scrum teams while supporting delivery deadlines.
Define and maintain security architecture for cloud infrastructure, APIs, and applications, including IAM, encryption, key management, and data protection standards.
Set security performance and maturity goals; select, implement, and manage security tools such as SIEM, vulnerability management, endpoint protection, and cloud security posture management.
Run threat modeling, penetration testing, and vulnerability management programs, and drive remediation.
Partner with Product and Engineering to deliver products, features, and integrations securely and meet audit requirements.
Run the enterprise cyber-risk program, including identifying, assessing, prioritizing, mitigating, and tracking risks in a risk register.
Ensure compliance with applicable financial-services and insurance frameworks and regulations, including SOC 2, NIST CSF / 800-53, ISO 27001, GLBA, and state privacy laws such as CCPA.
Manage internal and external audits, regulatory examinations, and client and partner security assessments; maintain evidence and remediate findings.
Run third-party and vendor risk management, including due diligence and ongoing monitoring of partners, carriers, cloud providers, and platform integrations.
Support and maintain data privacy and data governance programs.
Develop, maintain, and regularly test business continuity and disaster recovery plans.
Provide security and risk reporting, dashboards, and metrics to the CTO and executive team.
Build and mature security operations across monitoring, threat detection, and response.
Own the incident response program from preparation through post-incident review, coordinating with Legal, Communications, leadership, regulators, carriers, and affected partners as appropriate.
Lead security awareness and training programs, including phishing simulations, and monitor the threat landscape to adjust defenses and priorities.
Personally operate day-to-day security functions and foster a security-first culture across the company.
Partner across the company as a trusted security advisor, communicate periodically with employees on security and risk, collaborate with senior leadership on related projects, and communicate professionally with co-workers, management, clients, and others.
Develop and manage security budgets, dashboards, and roadmaps, and build, hire, manage, and develop a security team as the function grows.