SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 220,000 - 250,000 / annual
DriveWealth is a global B2B fintech platform democratizing access to financial markets through an API-based infrastructure. The company enables partners to offer seamless investing and trading experiences worldwide, supporting US equities, mutual funds, ETFs, fixed income, and options trading.
As Head of Security Engineering, you will report to the Chief Information Security Officer and own the security engineering strategy, roadmap, and delivery across DriveWealth's product platform and corporate environment. You will build and lead the Security Engineering team, define its strategic direction, and deliver improvements that protect customer data, support firm growth, and meet regulatory obligations.
Key responsibilities include:
**Strategy & Team Leadership:** Define and deliver a multiyear security engineering strategy and quarterly roadmap across product and corporate environments, aligning architecture standards with business priorities and risk appetite. Hire, coach, and develop high-performing security engineers. Manage backlogs, budgets, vendors, and dependencies while communicating progress and residual risks to the CISO and technology leaders.
**Product & Corporate Security:** Embed threat modeling, architecture reviews, security testing, and secure design into development and CI/CD pipelines. Secure AWS infrastructure (EKS, EC2, DynamoDB) and co-located trading infrastructure through least privilege, segmentation, encryption, and hardening. Partner with IT to mature identity and access governance, endpoint security, remote access, DLP, and SaaS security. Build scanning and remediation capabilities across cloud, on-premises, code, dependencies, containers, and infrastructure.
**Security Operations Enablement:** Build, integrate, and maintain infrastructure and services for monitoring, investigation, exposure management, and response (SIEM, SOAR, endpoint security). Own security data pipelines ensuring coverage, quality, enrichment, and appropriate retention. Deliver detection and response automation with Security Operations and provide incident engineering support.
**Compliance & Assurance:** Partner with Legal, Compliance, and GRC to implement SEC and FINRA requirements, including SEC Rule 17a-4 controls. Build and maintain capabilities for data discovery, classification, access control, encryption, and retention to support GDPR and privacy requirements. Automate control validation and evidence collection to support audits and regulatory examinations.
**Requirements:**
- 10+ years of relevant security, software, or infrastructure engineering experience, including 4+ years directly managing technical teams
- Demonstrated success owning a security engineering roadmap and delivering measurable improvements across production and corporate environments
- Expertise in AWS and Kubernetes security, with practical experience securing APIs and modern software delivery pipelines
- Strong working knowledge of identity and access management, macOS and Windows endpoint security, remote access/SASE, network security, and SaaS security; experience with Okta, JumpCloud, or comparable platforms
- Experience building and maintaining security platforms, telemetry pipelines, and automation used by security operations teams
- Ability to review code and infrastructure changes and contribute engineering solutions using Python, Java, or comparable languages and infrastructure-as-code tools such as Terraform
- Sound judgment balancing security, reliability, developer productivity, and cost
- Ability to influence technical decisions and communicate clearly with executives, engineers, and business partners
- Experience delivering security capabilities in regulated financial services or another environment with demanding availability, data protection, and audit requirements; brokerage, trading infrastructure, and SEC/FINRA experience preferred
- Bachelor's degree in a related field or equivalent practical experience; relevant security, AWS, or Kubernetes certifications a plus
