Security GRC Analyst – Mergers & Acquisitions

Kraken Digital Asset Exchange

. Own security governance, risk, and compliance across Payward acquisitions .

Posted 11/12/2026full-timeRemote • United KingdomMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security governance, risk management, and compliance within regulated financial services and fintech environments. Proficient in assessing control maturity, developing remediation plans, and integrating acquired entities into existing compliance frameworks.

Highest-signal resume keywords

Security GovernanceRisk ManagementCompliance Program IntegrationSOX/ICFR IT General ControlsISO 27001 Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security GovernanceRisk AssessmentControl Maturity AssessmentRemediation PlanningEvidence CollectionControl MappingProject ManagementAudit PreparationThird-Party IntegrationPolicy Management

Soft Skills

Sound JudgmentRelationship BuildingEscalation Management

Certifications & Qualifications

CISACRISCCISMCISSPISO 27001 Lead Implementer

Industry Keywords

Regulated Financial ServicesFintechVirtual Asset EnvironmentsM&APost-Merger Technology IntegrationPKM

About the role

Key responsibilities & impact

Own security governance, risk, and compliance across Payward acquisitions
Assess acquisition targets against Payward’s security baseline during diligence or immediately post-close
Map acquired-company controls to Payward’s framework and applicable external frameworks
Score entity-level control maturity and document scoring rationale
Define and sequence risk-based remediation milestones with dates, owners, and risk reductions
Track remediation to closure and escalate overdue or material risks
Recommend full platform migration or an absorbable steady-state maturity endpoint
Load acquired-entity risks into and maintain the enterprise risk register
Prepare acquired entities for external audit scope, including evidence collection and walkthrough support
Serve as Security GRC contact for acquired-company leadership, finance, and internal audit
Maintain entity-specific policy coverage and policy libraries
Feed recurring findings into future diligence processes
Document a repeatable onboarding process
Prepare entities for external audit inclusion and support fieldwork
Hand entities over to central GRC coverage with documented handover
Integrate third parties and vendors into Payward

Requirements

What you’ll need

5-7+ years in security governance, IT risk, or compliance, including regulated financial services, fintech, or virtual asset environments
Direct experience onboarding an acquired company into an existing controls or compliance program
Working knowledge of SOX/ICFR IT general controls and external-audit evidence requirements
Experience with at least two of ISO 27001, SOC 1, SOC 2, and PCI DSS, including mapping controls across frameworks
Ability to assess control maturity and set remediation plans
Hands-on delivery, including writing scope, collecting evidence, and closing gaps
Sound judgment on priorities and escalation of leadership decisions
Ability to build working relationships with IAM, infrastructure, and engineering control owners
Ability to translate control gaps into actionable risk language
Strong project management across cross-functional, distributed teams
Preferred: CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer
Preferred: M&A or post-merger technology integration experience
Preferred: familiarity with PKM

Benefits

Comp & perks

Remote-first, international team
Dogfooding a Kraken product is required once hired
Equal opportunity employment
Job-related skills or work-style assessments applied consistently
Ongoing application acceptance unless a deadline is stated