Head of Information Security [ONSITE- BERWYN, PA]

About the Opportunity:

The Head of Information Security plays a critical role in protecting FIDx's platform, data, and reputation as the company scales its mission of modernizing annuity distribution. As a senior security leader in the firm, the Head of Information Security is responsible for defining and executing the company's information security, data privacy, and cyber-risk strategy - safeguarding the sensitive financial and personal data that flows across our platform and our deep integrations with carriers, advisors, and partners. This position brings executive security experience, an execution mindset, and a bias toward action to embed security into every layer of the business. The role reports to the Chief Technology Officer, with regular, direct engagement with the CEO, executive team, and Board on matters of risk and security posture.

The position encompasses a wide range of activities with involvement in all phases of security governance, risk and compliance, security architecture, security operations, and incident response. It requires exemplary energy and work ethic, excellent people skills, and business acumen. The Head of Information Security is responsible for planning, organizing, directing and controlling the day-to-day security operations of the firm, and for directing the implementation of the firm's security policies - balancing rigorous protection with the speed and agility of a growing fintech.

As an early-stage, small company, FIDx expects this to be a hands-on, roll-up-your-sleeves role. Out of the gate the Head of Information Security will personally own and operate the security function - effectively a team of one - doing the work directly rather than managing others who do it. As the company scales, this leader will have both the opportunity and the responsibility to build, hire, and lead a dedicated security team.

This is an engaging position for a dynamic self-starter that requires significant attention to detail, entrepreneurial thinking and efficient and effective decision making. This person is entrepreneurial, self-directed and passionate about protecting the experiences we deliver to customers, advisors, investors, clients, and employees.

Essential Functions

• Own and operate the firm's information security program, and serve as the firm's primary subject matter expert on cybersecurity, data privacy, and information-security compliance.
• Establish, own, and continuously mature the enterprise information security program, including policies, standards, and controls, for approval by the CTO and executive team.
• Support strategic planning for the future and assessing the security implications of new product lines, markets, and partnerships, and recommending how to pursue them securely.
• Build a strong understanding of both the technology and business aspects of the product, as security must enable delivery of the platform rather than impede it.
• Run the company's day-to-day security operations, creating security strategies and policies, communicating them across the organization, and building company-wide alignment with a security-first culture.

Security Strategy, Architecture & Execution (35%):

• Build and execute the information security roadmap in alignment with the strategy and priorities set with the CTO and executive team.
• Work directly with development and DevOps staff to embed security into the SDLC - secure-by-design principles, secure coding standards, code review, and dependency/supply-chain management.
• Provide hands-on technical guidance to scrum teams as necessary to ensure security requirements are met without compromising delivery deadlines.
• Define and maintain security architecture across cloud infrastructure, APIs, and the application layer; establish standards for identity and access management (IAM), encryption, key management, and data protection.
• Set comprehensive goals for security performance and maturity; select, implement, and manage the security toolchain (e.g., SIEM, vulnerability management, endpoint protection, cloud security posture management).
• Run threat modeling, penetration testing, and vulnerability management programs, and drive timely remediation.
• Partner with Product and Engineering to ensure new products, features, and integrations are delivered securely.
• Lead day-to-day Security functions in partnership with the CTO and DevOps, ensuring our technology and processes are secure and meet audit requirements.

Risk Management, Compliance & Audit (40%):

• Run the enterprise cyber-risk management program: identify, assess, prioritize, and mitigate information-security and data-privacy risks, and maintain a clear risk register.
• Ensure compliance with applicable regulatory and industry frameworks relevant to insurance and financial services (e.g., SOC 2, NIST CSF / 800-53, ISO 27001, GLBA, and state privacy laws such as CCPA).
• Manage and coordinate internal and external audits, regulatory examinations, and client and partner security assessments; maintain evidence and drive remediation of findings.
• Run third-party and vendor risk management, including due diligence and ongoing monitoring of partners, carriers, cloud providers, and platform integrations.
• Support and maintain data privacy and data governance programs.
• Develop, maintain, and regularly test business continuity and disaster recovery plans.
• Provide timely, accurate and complete reporting, dashboards, and metrics on the firm's security and risk posture; write and submit reports to the CTO and executive team on all matters of importance.

Security Operations & Incident Response (20%):

• Build and mature the firm's security operations capability across monitoring, threat detection, and response.
• Own the incident response program end to end - preparation, detection, containment, eradication, recovery, and post-incident review.
• Coordinate incident handling with Legal, Communications, leadership, regulators, carriers, and affected partners as appropriate.
• Lead security awareness and training programs across the organization, including phishing simulations, to build a security-conscious workforce.
• Continuously monitor the threat landscape and adjust the firm's defenses, controls, and priorities accordingly.
• Personally own and operate the firm's day-to-day security functions in a hands-on capacity, instilling practices that mirror the adopted core values of the company. Bottom line: help build an amazing, resilient company.

Leadership, Culture & Team Building (5%):

• Assure a team mentality and culture: partner effectively across the company to drive our culture and execute on our common goals.
• Act as a trusted security partner and advisor to every team, embedding security into how the whole company works rather than relying on a large dedicated staff.
• Manage periodic employee communications on security and risk matters.
• Collaborate with senior leadership on related projects as they arise and in meeting overall deliverables.
• Communicate with co-workers, management, clients and others in a courteous and professional manner.

Education, Skill and Experience Required

• A minimum of 7-15 years of experience in information security / cybersecurity, with a history of upward progression working up through the ranks into senior leadership.
• Financial services, insurance, and/or fintech and start-up experience strongly preferred.
• Must have a minimum of a bachelor's degree (Computer Science, Information Security, or a related field). Master's degree or MBA preferred.
• Industry security certifications strongly preferred (e.g., CISSP, CISM, CRISC, CISA, or CCSP).
• Must have direct, hands on experience building or running an enterprise information security program, ideally from an early stage, including hands-on execution across multiple security domains.
• Must have a strong background in cloud security and API security coupled with secure SDLC / DevSecOps and application/product-security experience.
• Demonstrated expertise across security frameworks and regulations relevant to financial services and insurance (e.g., SOC 2, NIST, ISO 27001, GLBA, CCPA).
• Proven experience leading incident response and managing security incidents through to resolution.
• Experience owning third-party / vendor risk in a heavily integrated platform environment.
• Responsible for developing and managing security budgets, dashboards, and roadmaps.
• Requires strong leadership skills as well as the ability to approach situations from an entrepreneurial point of view.
• Comfortable operating hands-on as effectively a team of one initially, with the demonstrated ability to build, hire, manage, and develop a security team as the function grows.
• Previous experience in a client-facing role with the ability to effectively communicate with all levels of employees, including board members and C-level executives, as well as auditors, regulators, and partners.
• Ability to translate complex security and risk concepts into clear business terms for a diverse array of customers and employees.
• Experience with change management, strategic vision implementation, and team development/leadership.
• Must be highly collaborative, respectful and effective working across a wide array of vendors, employees, leadership team, board members, carriers, etc.
• Capability to interact with, support and participate as a member of our management team.
• Strong decision-making and organizational skills.
• Reliable, detail oriented and highly motivated.
• Knowledgeable and experienced enough to step right into a fast-paced work environment.

Work Environment

This job operates in an office and professional environment. This role routinely uses standard office equipment such as computers, phones, photocopiers, filing cabinets and fax machines. On occasion the job will require going out in the field, visiting vendors and partners.

Travel

Travel is required up to 20% of the time and based on the needs of the operation and business.

Position Type and Expected Hours of Work

This is a full-time, exempt position. Designated days and schedule will be primarily Monday-Friday, though will also be based on the needs of the operation and business, requiring weekends, nights and early mornings; especially given the state and early stages of the company and the on-call nature of security incident response.

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required in connection with this position. Duties, responsibilities, and activities may change at any time with or without notice.This position is classified as Exempt and not eligible for overtime pay.