About the roleAs RFA's CISO, you own security for RFA and its clients. You lead RFA's GRC, SOC, and vCISO teams, act as the senior security advisor to client leadership, and make sure RFA itself holds up to the scrutiny of the most demanding funds. You'll report to RFA's COO and work closely with RFA's service delivery and engineering teams, and with Titan's product and engineering teams.
You own and measure success by client outcomes (incidents prevented and contained, audits and DDQs passed), growth and retention of RFA's security revenue, and an RFA that passes every client security review.
This role is remote (US).
In this role you will- Set RFA's security strategy and lead RFA's GRC, SOC, and vCISO teams, who report to you
- Build and run RFA's client security offering: vCISO, managed detection and response, SOC, vulnerability management, email security, and incident response, with AI agents doing the volume and people doing the judgment
- Be the trusted security advisor to client CFOs, COOs, and CCOs: board and investment committee updates, regulatory readiness (SEC, FINRA, Reg S-P, state privacy rules), and investor DDQs
- Lead incident response for RFA clients, from first alert to client communication and lessons learned
- Own RFA's own security and compliance program, including SOC 2 and the security questionnaires clients send us
- Work with Titan's engineers to make sure the AI agents working in client environments are safe: least-privilege access, guardrails, logging, and audit trails
- Guide RFA clients adopting Claude, ChatGPT, and Copilot on AI governance: data boundaries, connector and permission review, shadow AI discovery
- Join sales cycles as RFA's security voice: win the client's CISO or CCO, and turn what we learn into packaged services and pricing
You might thrive in this role if you- Bring 10+ years in security, including leading a security function or practice as CISO, VP, or Head of Security
- Have built or run security services at an MSP, MSSP, or security consultancy, ideally serving financial services firms
- Know what hedge funds, PE firms, and asset managers need from security: SEC cybersecurity rules, Reg S-P, investor DDQs, and frameworks like NIST CSF, SOC 2, and ISO 27001
- Are hands-on with Microsoft 365, Entra ID, Intune, Defender, and modern EDR, SIEM, and email security stacks
- Are excited, not threatened, by AI agents doing security work, and have opinions on how to make them safe
- Can explain risk to a fund COO in plain language and to an engineer in technical detail
- Take extreme ownership and would rather build the program than inherit one
Bonus- CISSP, CISM, CISA, or CRISC
- vCISO experience across multiple financial services clients
- Experience securing LLM applications or AI governance work (e.g., ISO/IEC 42001, NIST AI RMF)
LogisticsLocation: Remote (US)
Travel: Under 5%, for occasional client meetings and time with the team in NYC
