Sr. Security Engineer - GRC APAC Fintech & Financial Services

We are seeking an experienced Governance, Risk, and Compliance (GRC) Engineer focused on Japanese information security and financial services regulation to help scale compliance for SpaceXAI and X Money.

As we expand deeper into the regulated Japanese market, maintaining a robust, transparent, and technically sound information security GRC program is critical. You will architect the systems and processes that automate trust , a pragmatic operator who understands that GRC exists to enable the business, balancing rigorous standards with the velocity of a high-growth company.

Responsibilities:

• Own and evolve Japan financial services and payments compliance posture across JFSA supervisory expectations, APPI, and local Japanese banking and payments technology controls supporting X Money.
• Build and maintain Compliance-as-Code capabilities , policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD.
• Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance.
• Partner with Architects and Engineering Leads to bake JFSA and APPI requirements into design early.
• Design, implement, and validate technical controls relevant to Japanese banking and payments environments.
• Operate the cybersecurity and compliance risk register , identify, quantify, and track risks.
• Lead risk assessments and compliance reviews for new products, payment flows, features, vendors, and architectural changes.
• Liaise with Legal and the Data Privacy team on security-relevant intersections with APPI.
• Own and cultivate relationships with external auditors, assessors, and JFSA supervisory contacts.
• Develop, maintain, and continuously improve policies, standards, and procedures aligned to JFSA, APPI, and local banking and payments technology requirements.

Basic Qualifications:

• Bachelor's degree in computer science, Information Security, Cybersecurity, risk management, or an engineering/STEM field , or equivalent practical experience.
• 8+ years of experience owning or materially operating a GRC, information security compliance, or ISMS program in fintech, banking, payments, SaaS, or other regulated technology environments , with primary Japan exposure.
• Demonstrable experience owning or materially operating an ISMS and control library.
• Hands-on experience with JFSA supervisory expectations and local Japanese banking and payments technology controls.
• Strong understanding of information security risk management, control assessment, risk treatment, and governance reporting.

Preferred Skills and Experience:

• 10+ years of information security compliance, GRC engineering, or technology audit experience in fintech or financial services with a primary Japan focus.
• Experience in a SaaS, fintech, financial services, regulated technology, or B2B enterprise software environment.
• Hands-on experience implementing technical controls and integrating compliance checks into CI/CD / DevSecOps pipelines.
• Familiarity with secure SDLC practices.
• Deep familiarity with JFSA expectations for technology risk management, third-party technology risk, and incident reporting.