Head of IT/Compliance

Footprint • New York City, NY

3d

About The Position

Footprint is the agentic platform that learns your compliance program and runs it end to end. Compliance teams at banks and fintechs are drowning in financial crimes investigations. Transaction volumes are surging, regulators keep raising the bar, and the work still runs on manual review queues stitched together from legacy vendors. Percy, our agentic system, learns each team's procedures and makes the same calls their analysts would: clearing false positives, escalating real risk, writing the case narrative, and documenting every decision for audit. It cuts review workloads by 70%+. The harder problem is underneath. Every investigation is grounded in the data sources compliance teams already trust, and every case commits to an organizational memory that compounds — so a pattern one analyst caught in March surfaces automatically in October, across KYC, EDD, sanctions, and monitoring. Whether the team is five analysts or 500, they share one brain. Every memory carries provenance. Agents propose; humans approve. That's four years of identity infrastructure sitting under the agent, and it's the part nobody can bolt on later. We're backed by QED, Index, and Box Group, and trusted by FDIC- and OCC-regulated banks plus fintechs like Bilt, Nuvei, and MoonPay. We 5x'd revenue last year. The team is small, senior, and ships fast.

The Role
For four years, Footprint's security and compliance work has been the CTO's responsibility. SOC 2 Type 2, PCI DSS Level 1, GDPR, and ISO 27001 all got stood up and kept live. The internal systems underneath them got built the same way: SSO, device management, access control, and dozens of vendor relationships. We are hiring this first dedicated IT and Compliance role early for two reasons. First, Footprint helps companies be compliant, so we hold ourselves to the highest standards here. Our customers are banks and fintechs who trust us with some of the most sensitive data there is, and proving we deserve that trust - security questionnaires, report requests, audits - is core to how we sell, not a cost center. Second, we believe our compliance program should push the frontier on what a secure organization touching this kind of data should be. You're inheriting a real program with all four frameworks live and passing. We're in good health; we need you to take us to the next level. The mandate is to take a compliance program that passes its audits and build one that's ahead of them: vendor management, data lifecycle, endpoint coverage, and the system of record itself all become yours to systematize, and to keep pace with everything we're building next, including agentic systems. You'll own these decisions and have the trust and ownership to change how we approach this today. You'll report directly to Alex Grinman, our CTO.

Requirements

• Owned at least one compliance program end to end: scoped it, ran the audit with the auditor, and closed the findings yourself.
• Been the person accountable for control state in Vanta, Drata, or an equivalent platform.
• Run a workforce device fleet on a modern MDM and endpoint security stack.
• Owned SSO and directory management, including the offboarding path.
• Been the entire IT and compliance function at a company, with no specialist team behind you.
• Made a documented risk-acceptance call under real resource constraints and can walk through the reasoning.
• Can explain a technical control to someone non-technical without jargon. You'll do it in the first conversation.

Nice To Haves

• PCI DSS Level 1 program ownership. It’s the scarcest piece of this scope and the hardest of our four frameworks to learn on the job.
• An engineering background of any depth. You’ll set access and device policy that engineers live inside every day, and it helps to have been on their side of it.
• Fintech, payments, or another regulated environment. We’re a company built on detecting and stopping financial crime, so knowing what a regulator actually asks for counts for a lot here.
• Built a compliance function from zero at a company under 200 people. That’s the exact shape of this job.
• Security and cryptography standards. To us, caring about this is an indicator that you’re thoughtful about security.

Responsibilities

• Own the compliance programs: SOC 2 Type 2, PCI DSS Level 1, GDPR, and ISO 27001, with Vanta as the system of record. Own the control state, the evidence, and the audits with our external auditors. Own the judgment underneath them: which findings we fix now, which risks we accept and document, and where an auditor’s ask deserves an argument.
• Own identity and access: SSO, directory management, and the authentication and authorization policies behind them. Onboarding and offboarding run end to end through you, including the revocation path that has to be airtight the day someone leaves. Set the access standard for every internal service and tool we use.
• Own the device fleet: Endpoint protection and device security across every workforce machine. Own the coverage standard, the tooling choices, and the enforcement model, and defend them to the engineers who live inside them.
• Own technology vendors and spend: Dozens of tools, each carrying a security review, a SOC 2, ISO, or PCI risk report in Vanta, and a spend line. Design and own the vendor process: the security and IT review on anything new we adopt, and the renew-or-cut calls on infrastructure spend.
• Own security and cloud operations: Own the relationship with our pentesters and scanning vendors, and their results as audit evidence. Workforce and vendor-stack alerts run through you to resolution. Own cloud operations, and the documentation of how our infrastructure fits together. Own disaster recovery and the data-lifecycle program, retention through deletion, and test them on a schedule you set.
• Own compliance as something Sales can use: Own the customer-facing edge of the program: the report package Sales hands a prospect directly, and the hard answer on a security questionnaire when one comes back.

Benefits

• Generous compensation and equity packages
• Free lunch and dinner (after 7pm)
• Monthly wellness stipend
• Unlimited PTO
• Fully covered health, dental, and vision insurance
• The chance to help shape the future of internet identity and financial crime prevention

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed