SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Dave is a fintech company building financial products for underserved Americans, offering affordable access to liquidity and credit. This is a new, high-ownership role reporting to the Sr. Director of Security & IT, focused on building and operating Dave's technology governance program from the ground up.
You will own the complete governance operating model across technology risk, cyber risk, IT controls, change management, incident management, business continuity, and policy frameworks. Key responsibilities include:
- Build and maintain Dave's technology control inventory with clear owners, evidence requirements, operating cadence, exceptions, and escalation paths.
- Own technology assurance and audit readiness across SOX ITGC, PCI, SOC 2, and other applicable frameworks. Coordinate evidence, support testing, identify gaps, and drive remediation accountability.
- Manage the technology and cyber risk register and control exception process. Surface material or sustained risks with clear context and recommendations, including escalation when stakeholders resist.
- Govern change management, incident management, and business continuity to ensure expectations are practical, consistently followed, tested, and improved.
- Leverage AI and automation thoughtfully to improve evidence analysis, control mapping, policy maintenance, risk reporting, audit preparation, and remediation tracking while maintaining appropriate human review.
You will not own technical remediation; instead, you'll define what good governance looks like, establish accountability, challenge gaps, and ensure material risks reach the right decision-makers. You'll partner closely with Security, IT, Engineering, Data, Internal Audit, Legal, Compliance, and external assessors to build a governance model that works in practice.
The role offers significant autonomy to shape a new function at a growing public fintech. Your work will help teams understand risk, strengthen operational resilience, meet regulatory obligations, and build systems that scale with the business. Dave is virtual-first; team members can work anywhere in the United States except Hawaii.
REQUIREMENTS:
- 8+ years of relevant technology experience, including significant ownership in security governance, technology risk, or security assurance.
- Personally led a SOC 2 Type II, ISO 27001, or equivalent audit through successful completion—not just supported audit preparation.
- Built or materially rebuilt a governance, risk, or assurance operating model rather than only administering an established program.
- Strong technical fluency across cloud, identity, CI/CD, source control, endpoints, networks, and data platforms. Ability to turn ambiguous expectations into specific, testable controls.
- Experience owning accountability while technical teams own remediation. Demonstrated ability to influence Engineering, SRE, Security, IT, and Data partners without taking their work over.
- Sound judgment around risk and materiality, including demonstrated experience escalating meaningful risks when stakeholders disagreed.
- Experience partnering credibly with Internal Audit and Legal in addition to technical and Security teams.
- Strong written communication and program management skills.
BONUS:
- Experience with SOX ITGC, PCI DSS, NIST-based programs, AI governance or third-party AI risk, and GRC automation platforms such as Vanta or Drata.
