Information Security Lead
Nova Credit · New York, NY
About this role
**Nova Credit — Information Security Lead** Nova Credit is a credit infrastructure and analytics company enabling responsible growth by harnessing alternative credit data. The company supports thousands of businesses with compliant, actionable risk analytics and customer-trust programs. As Nova Credit’s **Information Security Lead**, you’ll be a hands-on, all-rounder security practitioner partnering closely with the **Director of Information Security** to mature the security program—moving fluidly between deep technical execution and **GRC** work that supports trust with large financial institutions. --- ## Hybrid / Location - **Hybrid:** 3 days per week in office on **Mondays, Tuesdays, and Thursdays** - **Based in:** New York City Metropolitan area --- ## What you’ll do ### Within the first month - Build a working understanding of Nova Credit’s products, **AWS-based infrastructure**, and key security-relevant data flows - Familiarize yourself with control sets/frameworks/policies (**SOC 2 Type II, ISO 27001**, internal standards) and customer-facing security commitments - Get hands-on with the security tooling stack (e.g., **EDR, MDM, SSO/IAM, DLP, cloud security posture management**) - Shadow customer security questionnaires and due diligence reviews to learn cadence and source-of-truth artifacts - Take on initial hands-on tickets (e.g., endpoint hardening, MDM tuning, IAM cleanup, evidence collection) - Meet cross-functional stakeholders ### Within the first quarter - Start owning customer security questionnaires and due diligence reviews end-to-end (intake → evidence pulls → responses → follow-up calls) - Configure, tune, and operate security tooling across the stack (e.g., **EDR, MDM, SSO/IAM, DLP, Google Workspace settings**) - Triage and respond to security alerts, bug bounty reports, and internal escalations; document repeatable runbooks - Contribute to third-party risk reviews for new vendors and re-reviews of critical suppliers - Identify and propose fixes for at least one process gap/control weakness ### Within the first year - Own an agreed slice of the security program end-to-end (e.g., **IAM/SSO, endpoint/MDM, vulnerability management, customer-trust/questionnaire program, or third-party risk**) with measurable outcomes - Own customer security questionnaires and due diligence reviews end-to-end - Drive at least one significant hardening or modernization initiative - Serve as a go-to internal expert for technical security questions (Engineering, Product, Data Science) - Partner with the Director of Information Security on roadmap, prioritization, and scaling the program as Nova grows --- ## Your skillset - **Experience:** 3–6+ years across information security, security engineering, cloud security, or technical GRC (fintech/financial services/regulated SaaS preferred) - **Hands-on technical depth:** Comfortable configuring/operating modern security tooling (**EDR, MDM, SSO/IAM, DLP, cloud security tooling**). **Jamf, SentinelOne, Okta** are a plus. - **Cloud security:** Working knowledge of **AWS security, IAM, networking, KMS, logging**, and common misconfiguration risks - **Foundational concepts:** Networking, identity, cryptography, secure SDLC, and web application security (not required to be offensive, but should understand attacker thinking) - **GRC / audit fluency:** Direct experience with **SOC 2 Type II** and **ISO 27001** is a plus - **Communication:** Can explain technical risk, write clean policy, and
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.