About
SpaceX develops technologies for space exploration with the goal of making life multiplanetary. SpaceXSI builds Super Intelligence across compute, models, and applications to expand humanity's knowledge and capabilities.
Responsibilities
•Own and evolve EU/UK financial services and digital operational resilience posture across DORA and related EBA/ESMA/EIOPA guidance, PSD2/PSR where applicable, and UK PRA/FCA requirements supporting xMoney
•Build and maintain Compliance-as-Code capabilities, including policy-as-code, automated control validation, continuous evidence collection, and CI/CD-integrated monitoring
•Operate and extend GRC platforms such as Vanta, integrating them with cloud, identity, logging, and engineering systems
•Partner with Architects and Engineering Leads to embed EU/UK information security and regulatory requirements into designs and translate obligations into technical implementations and audit-ready narratives
•Design, implement, and validate technical information security controls for regulated EU/UK environments
•Operate the cybersecurity and compliance risk register by identifying, quantifying, and tracking risks
•Lead information security risk assessments and compliance reviews for products, features, vendors, and architectural changes affecting the EU/UK regulated attack surface
•Liaise with the Data Privacy team on security-related matters, including measures supporting confidentiality and integrity
•Own relationships with external auditors, assessors, and applicable supervisory contacts on information security topics
•Develop, maintain, and improve information security policies, standards, and procedures aligned with DORA, the EU AI Act, NIS2 where in scope, ISO 27001, and SOC 2
•Champion pragmatic governance by prioritizing real security or business risks over checkbox compliance
•Take on additional tasks and responsibilities as needed to support the team and evolving business priorities
Requirements
•Bachelor's degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field
•8+ years of experience in GRC, information security compliance, or technology audit roles in fintech, banking, payments, or other heavily regulated environments with EU and/or UK exposure
•Hands-on experience implementing or operating controls under several of DORA, the EU AI Act, NIS2, PSD2/PSR, or UK PRA/FCA operational resilience expectations
•Familiarity with EU/UK data privacy regulations, including EU GDPR, UK GDPR, and the UK Data Protection Act 2018
•Experience with Compliance-as-Code practices and GRC automation tooling, with a focus on continuous monitoring and reducing manual evidence collection
•Technical fluency to collaborate with engineering on on-premises, hybrid, or cloud environments (AWS/GCP/Azure) and security architecture
Nice to have
•10+ years of relevant experience with a primary EU/UK focus
•Hands-on technical controls and CI/CD compliance checks
•ISO 27001 or SOC 2 programs
•GDPR security concepts
•DORA ICT third-party risk and TLPT
•EU AI Act security controls
•Related regional regimes
•Enterprise sales security reviews
•Risk register experience
•Analytical and project management skills
•Stakeholder communication skills
•CISSP/CISA/CISM/CRISC/ISO 27001 certifications
•Experience with EU/UK-regulated financial institutions, EMI/PI environments, or supervised fintechs
Conditions
•Occasional travel may be required
