SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
xAI is seeking an experienced Governance, Risk, and Compliance (GRC) Engineer to lead compliance and information security initiatives for the Japanese market, supporting SpaceXAI and X Money as they expand into regulated financial services and payments environments.
You will own the Japan financial services and payments compliance posture, with deep focus on JFSA (Japan Financial Services Agency) supervisory expectations, APPI (Act on Protection of Personal Information), and local Japanese banking and payments technology controls. This is a hands-on role that bridges security engineering and regulatory compliance—you'll architect systems and processes that automate trust while enabling business velocity.
Key responsibilities include:
- Building and maintaining Compliance-as-Code capabilities (policy-as-code, automated control validation, continuous evidence collection integrated into CI/CD)
- Operating and extending GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance
- Partnering with architects and engineering leads to embed JFSA and APPI requirements into design early, translating complex regulatory obligations into concrete technical implementations
- Designing, implementing, and validating technical controls relevant to Japanese banking and payments (access control, logging/monitoring, encryption, change management, vulnerability management, BCDR, secure SDLC)
- Operating the cybersecurity and compliance risk register—identifying, quantifying, and tracking risks under JFSA supervisory expectations
- Leading risk assessments and compliance reviews for new products, payment flows, features, vendors, and architectural changes affecting the Japan regulated attack surface
- Liaising with Legal and Data Privacy teams on security-relevant intersections with APPI
- Cultivating relationships with external auditors, assessors, and JFSA supervisory contacts
- Developing and maintaining policies, standards, and procedures aligned to JFSA, APPI, and local requirements, mapped to control libraries shared with US Fintech operations
- Championing pragmatic governance—prioritizing real security and business risk over checkbox compliance
The ideal candidate brings hands-on experience with JFSA supervisory expectations, APPI, and local Japanese banking and payments technology controls, plus GRC engineering skills. You understand that controls should be designed into the platform rather than bolted on after the fact. This is a small, highly motivated team operating with a flat organizational structure where all employees are expected to be hands-on and contribute directly to the mission.
Occasional travel may be required.
REQUIREMENTS:
- Bachelor's degree in computer science, Information Security, Cybersecurity, risk management, or an engineering/STEM field (or equivalent practical experience)
- 8+ years of experience owning or materially operating a GRC, information security compliance, or ISMS program in fintech, banking, payments, SaaS, or other regulated technology environments—with primary Japan exposure
- Demonstrable experience owning or materially operating an ISMS and control library, and supporting client security assurance, external audits, or regulatory evidence processes
- Hands-on experience with JFSA supervisory expectations and local Japanese banking and payments technology controls (implementing or operating controls, not only reading requirements)
- Strong understanding of information security risk management, control assessment, risk treatment, and governance reporting to senior stakeholders
- Experience coordinating security incident response governance (escalation, communications, remediation tracking) and operating or improving supplier/third-party security assurance
- Working knowledge of APPI sufficient to partner with Privacy counterparts on security of personal data and incident support
- Technical fluency to partner with Engineering on cloud (AWS/GCP/Azure), identity, logging, and secure SDLC—and to evaluate control objectives against real configurations
PREFERRED:
- 10+ years of information security compliance, GRC engineering, or technology audit experience in fintech or financial services with primary Japan focus
- Experience in SaaS, fintech, financial services, regulated technology, or B2B enterprise software environments
- Hands-on experience implementing technical controls (IAM, logging/monitoring, encryption, hardening) and integrating compliance checks into CI/CD/DevSecOps pipelines
- Familiarity with secure SDLC practices (threat modeling, SAST/DAST, dependency scanning, secrets management, application/API penetration testing, vulnerability remediation tracking)
- Deep familiarity with JFSA expectations for technology risk management, third-party technology risk, and incident reporting at banking and payments providers
- Experience enabling enterprise sales through trust centers, vendor questionnaires, client audits, and contractual security schedules for Japan clients
- Experience mapping a single control library across jurisdictions (e.g., US Fintech and Japan) to meet JFSA, APPI, and local requirements without duplicate control sets
- Experience supporting BC/DR and resilience evidence (dependency mapping, backup/restore testing, RTO/RPO validation)
- Proven ability to operate a risk register and apply judgment in gray areas—focusing on outcomes over optics
- Excellent communication and stakeholder management skills
- Certifications such as CISSP, CISM, CISA, CRISC, or equivalent
- Prior experience working with or within JFSA-supervised financial institutions, banking or payments providers, or supervised fintechs in Japan
- Based in Japan; fluency in English required; Japanese language proficiency a plus
