SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Alpaca is a US-headquartered global leader in agent-first brokerage infrastructure serving hundreds of financial institutions across 40 countries. The company provides institutional-grade APIs for stocks, ETFs, options, crypto, and fixed income trading to broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, totaling over 10 million brokerage accounts. Backed by $400 million in funding from top-tier investors including Portage Ventures, Spark Capital, and Y Combinator, Alpaca operates a globally distributed team of 400+ members.
This is a hands-on operator role with no direct reports. You will own the end-to-end execution of Alpaca's Enterprise Risk Management (ERM) program. Reporting to the CISO/ERM Lead, you will work closely with the ERM Working Group, functional risk leads, and local entity leaders.
Key responsibilities include:
- Run the ERM intake cycle end to end: ticket ingestion, functional interviews, surveys, and ad hoc signals from incidents or operational channels
- Maintain functional and enterprise risk registers in Vanta, including owners, inherent and residual scores, mitigations, and status
- Coordinate functional risk lead check-ins, chase blockers, and normalize inputs into the enterprise view
- Map risks to Alpaca's 15 L1 categories and Appendix C L2 subcategories to enterprise scenarios for reporting
- Apply the ERM Risk Scoring Model and push residual validation with risk owners
- Track mitigation plans, action owners, target dates, and escalations
- Define Key Risk Indicators (KRIs) with data owners; use proxy metrics where instrumentation is still maturing
- Produce leadership and board ERM materials
- Support ERM Working Group agendas, minutes, and action tracking
- Operate the intake triage workflow: score, dedupe, register action
- Build playbooks and templates for functional leads
- Support local entity quarterly risk updates and escalation hygiene
- Surface emerging risks (crypto, AI, multi-jurisdiction) for review
You will update risk registers yourself and run functional risk lead check-ins without delegating core execution work.
REQUIREMENTS (Must-Haves):
- Mid-career professional with roughly 5 to 10 years in operational risk, ERM, GRC, or compliance program management at a regulated financial institution (broker-dealer, fintech, or capital markets)
- Demonstrated experience building or running a risk register from intake through reporting (not framework design only)
- Ability to coordinate Legal, Compliance, Finance, Product, Security, and Operations stakeholders without direct authority
- Hands-on GRC platform experience
- Clear writing skills: risk statements, executive summaries, board-ready tables
- SEC/FINRA familiarity or equivalent regulated-environment experience
NICE-TO-HAVES:
- Broker-dealer, clearing, or custody operations context
- High-growth fintech experience where you stood up ERM while the business scaled
- Crypto/digital assets risk register exposure
- Multi-entity, multi-jurisdiction risk consolidation experience
- Jira Service Desk or structured intake workflow design
- COSO ERM or ISO 31000 implementation as an operator
- Prior experience drafting board or risk committee reporting
