SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 200,000 - 250,000 / annual
DriveWealth is a global B2B fintech platform democratizing access to financial markets through an API-based infrastructure. The company enables partners to offer seamless investing and trading experiences worldwide, supporting US equities, mutual funds, ETFs, fixed income, and options.
You will build and mature the Security & Threat Operations function, reporting to the Chief Information Security Officer. This is a hands-on leadership role combining strategic program development with direct operational involvement in threat detection, incident response, and exposure management.
**Key Responsibilities:**
**Program Maturity & Team Leadership:** Develop a measurable roadmap and operating model for Security & Threat Operations. Grow and lead the team through hiring, coaching, training, career development, and performance management.
**Threat Detection, Investigation & Intelligence:** Own the detection program incorporating threat intelligence, content development, proactive hunting, and validation through attack simulations. Manage security monitoring and investigation across product and corporate environments (phishing, malware, credential compromise, API abuse, DDoS, insider threats). Own digital risk monitoring covering external attack surfaces, leaked credentials, exposed data, impersonation, and phishing domains.
**Incident Response:** Partner with Security Engineering to build automated security response actions. Own the incident response lifecycle as Incident Commander, including preparedness, forensic evidence handling, containment, recovery validation, regulatory coordination, and post-incident improvement.
**Exposure Management & Control Operations:** Own the exposure management lifecycle from discovery through verified closure. Operate and tune operational security controls (DLP, WAF, email filtering, identity compromise prevention) in partnership with Security Engineering, DevOps, and Product teams.
**Compliance & Assurance:** Partner with Legal, Compliance, and GRC to implement SEC and FINRA requirements, including SEC Rule 17a-3 and 17a-4 controls. Support audits and regulatory examinations.
You will act as Incident Commander during significant security incidents, coordinate response across technical and business teams, and ensure defenses evolve with the company's AWS platform, Kubernetes services, low-latency trading infrastructure, and corporate technology.
**Location & Work Arrangement:**
If based in New York or Chicago: hybrid, expected to come into office on a cadence set by hiring manager. If based in Austin, Dallas, Denver, Miami, San Francisco, or Seattle: fully remote with occasional office visits. Remote work outside these locations is not available.
**Requirements:**
- 8+ years in security operations, detection engineering, incident response, or related disciplines
- 3+ years managing technical teams with experience building or maturing an operations function
- Demonstrated experience serving as Incident Commander during significant security incidents, making decisions under pressure, coordinating multiple teams, and communicating with executives and business stakeholders
- Strong hands-on expertise in threat intelligence, detection content development, SIEM and endpoint analytics, investigation, threat hunting, and defensive validation
- Practical scripting or query skills in Python, SQL, or comparable languages
- Working knowledge of AWS, Kubernetes, API security, identity, and Windows/macOS endpoint telemetry
- Experience creating, operating, and tuning preventive controls such as DLP, WAF, and email filtering while managing false positives
- Experience investigating insider threats and digital risks (exposed credentials, impersonation, phishing domains)
- Strong people leadership, process design, and prioritization skills; ability to influence Engineering and IT, manage competing demands, and support on-call escalation outside business hours
- Familiarity with NIST CSF, incident response practices, and MITRE ATT&CK
- Bachelor's degree in a related field or equivalent practical experience
- Preferred: Experience in regulated financial services (SEC/FINRA environments); relevant certifications (CISSP, GCIH, GCIA, GCFA)
Must be authorized to work in the United States without visa sponsorship.
