Information Security Lead

Nova Credit•New York, NY

4d•$118,400 - $140,600

About The Position

Nova Credit is hiring a hands-on Information Security Lead to help mature its information security program. The role combines technical security operations—such as configuring tools, hardening systems, investigating alerts, and automating controls—with governance, risk, and compliance work, including customer security questionnaires, audit support, control execution, and third-party risk reviews. The Information Security Lead partners closely with the Director of Information Security and works cross-functionally throughout the company, owning technical and program-level initiatives.

Requirements

3–6+ years of experience across information security, security engineering, cloud security, or technical GRC roles.
Hands-on ability to configure and operate security tools such as EDR, MDM, SSO/IAM, DLP, and cloud security tooling.
Working knowledge of AWS security, including IAM, networking, KMS, logging, and common misconfiguration risks.
Solid grasp of networking, identity, cryptography, secure SDLC, and web application security.
Ability to communicate technical risks to engineering colleagues, write policies, and engage productively with Engineering leads.
Willingness to perform both technical security work and GRC tasks, including completing customer security questionnaires.

Nice To Haves

Experience in a high-growth fintech, financial services, or regulated SaaS environment.
Knowledge of Jamf, SentinelOne, or Okta.
Direct experience with SOC 2 Type II and ISO 27001.

Responsibilities

Develop an understanding of Nova Credit’s products, AWS-based infrastructure, and security-relevant data flows.
Learn the company’s control sets, frameworks, policies, and customer-facing security commitments.
Operate and configure security tooling, including EDR, MDM, SSO/IAM, DLP, cloud security tooling, and Google Workspace settings.
Respond to customer security questionnaires and due diligence reviews, including gathering evidence, preparing responses, and attending follow-up calls.
Handle security tickets such as endpoint hardening, MDM tuning, IAM cleanup, and evidence collection.
Triage and respond to security alerts, bug bounty reports, and internal escalations; document repeatable response runbooks.
Contribute to third-party risk reviews for new vendors and reassessments of existing critical suppliers.
Identify and propose fixes for process gaps or control weaknesses.
Own an agreed-upon area of the security program end-to-end, with measurable outcomes.
Drive at least one significant security hardening or modernization initiative.
Serve as an internal technical security resource for Engineering, Product, and Data Science.
Partner with the Director of Information Security on roadmap, prioritization, and scaling the information security program.