Information Security Lead

Required

• Own an agreed-on slice of Nova Credit’s security program end-to-end, e.g., IAM/SSO, endpoint and MDM, vulnerability management, customer-trust/questionnaire program, or third-party risk, with clear, measurable outcomes.
• Own customer security questionnaires and due diligence reviews end-to-end, from intake to evidence pulls, to clean responses, and attending follow-up calls.
• Drive at least one significant hardening or modernization initiative
• Be a go-to internal expert for technical security questions from Engineering, Product and Data Science
• Partner with the Director of Information Security on roadmap, prioritization, and how our Information Security program scales as Nova grows
• Experience: 3–6+ years across information security, security engineering, cloud security, or technical GRC roles, ideally with at least some time in a high-growth fintech, financial services, or regulated SaaS environment.
• Hands-on technical depth: Comfortable configuring and operating modern security tooling such asEDR, MDM, SSO/IAM, DLP, and cloud security tooling. Knowledge of Jamf, SentinelOne, Okta are a plus
• Cloud security: Working knowledge of AWS security, IAM, networking, KMS, logging, and common misconfiguration risks. You can reason about real architecture and point out where the risks are.
• Foundational concepts: Solid grasp of networking, identity, cryptography, secure SDLC, and web application security. You don’t need to be an offensive security specialist, but you should know how attackers think.
• GRC / audit fluency: Direct experience with SOC 2 Type II and ISO 27001 are a plus.
• Communication: You can explain a technical risk to engineering team members, write a clean policy, and disagree productively with an Engineering lead in the same week.
• All-rounder mindset: You are equally willing to dig into a misconfigured IAM policy and fill out a 200-question bank questionnaire. You don’t silo the work into “technical” and “non-technical.”