SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 118,400 - 140,600 / annual
Nova Credit is a fintech infrastructure company that enables businesses to make smarter credit decisions by harnessing alternative credit data and cross-border credit infrastructure. The company serves over 7,000 businesses including HSBC, SoFi, Scotiabank, AppFolio, and Yardi through solutions like Cash Atlas, Income Navigator, Eligibility Compass, and Credit Passport.
As Information Security Lead, you will be a hands-on security practitioner partnering closely with the Director of Information Security to mature Nova Credit's security program. You will move fluidly between deep technical work—configuring security tooling, hardening systems, investigating alerts, and automating controls—and Governance, Risk, and Compliance (GRC) work that earns trust from major financial institutions, including responding to customer security questionnaires, supporting SOC 2 Type II and ISO 27001 audits, executing control sets, and running third-party risk reviews.
In your first month, you will develop working knowledge of Nova Credit's AWS-based infrastructure and data flows, familiarize yourself with control frameworks and policies, get hands-on with the security tooling stack (EDR, MDM, SSO/IAM, DLP, cloud security posture management), shadow customer security questionnaires, pick up hands-on tickets for endpoint hardening and IAM cleanup, and meet cross-functional stakeholders.
Within your first quarter, you will own customer security questionnaires and due diligence reviews end-to-end, configure and operate security tooling across the stack, triage and respond to security alerts and bug bounty reports, contribute to third-party risk reviews, and identify process gaps or control weaknesses.
Within your first year, you will own an agreed-upon slice of Nova Credit's security program end-to-end (e.g., IAM/SSO, endpoint and MDM, vulnerability management, customer-trust program, or third-party risk), drive at least one significant hardening or modernization initiative, become a go-to internal expert for technical security questions from Engineering, Product, and Data Science, and partner with the Director on roadmap and scaling.
REQUIREMENTS:
- 3–6+ years of experience in information security, security engineering, cloud security, or technical GRC roles, ideally with time in high-growth fintech, financial services, or regulated SaaS environments
- Hands-on technical depth: comfortable configuring and operating modern security tooling such as EDR, MDM, SSO/IAM, DLP, and cloud security tooling; knowledge of Jamf, SentinelOne, Okta is a plus
- Cloud security: working knowledge of AWS security, IAM, networking, KMS, logging, and common misconfiguration risks; ability to reason about real architecture and identify risks
- Foundational concepts: solid grasp of networking, identity, cryptography, secure SDLC, and web application security; understanding of attacker mindset
- GRC/audit fluency: direct experience with SOC 2 Type II and ISO 27001 is a plus
- Communication: ability to explain technical risk to engineering teams, write clean policies, and disagree productively with engineering leadership
- All-rounder mindset: equally willing to dig into misconfigured IAM policies and complete detailed questionnaires; no siloing of technical vs. non-technical work
About Nova Credit
Fintech — consumer-permissioned credit data and cross-border credit infrastructure.
