Security GRC Analyst, Mergers & Acquisitions

Building the Future of Open Finance Payward - the parent company behind Kraken, Ninja Trader, Breakout, xStocks, Payward Services and CF Benchmarks - has spent the last 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system.

The team Founded in 2011, Kraken is one of the world's longest-standing crypto platforms, trusted by over 10 million individuals and institutions across the globe. It offers spot trading, margin, futures, staking, and OTC services, with products built for both individual investors and institutional clients.

We are looking for a Security GRC Lead to own security governance, risk, and compliance across Payward's acquisitions. You will be the accountable owner for bringing each acquired company from its own control environment into ours, working with the M&A Technology Team from diligence through to either full platform migration or steady-state coverage under our central program.

Payward acquires and integrates companies continuously, across multiple jurisdictions and regulatory regimes. Every target arrives with its own controls, its own maturity level and its own audit history, and every one enters our financial statement audit scope on a timeline set by the deal rather than by readiness. Today that work competes for the same people who run controls for the parent company.

This role exists so that it has a dedicated owner.

This is a build role to uphold the repeatable process for assessing an acquired company against our security baseline, mapping its controls into our compliance frameworks,and setting remediation milestones a newly acquired team can realistically hit. You will then run it, deal after deal, and you are accountable for the work getting done.

The opportunity

Assess each acquisition target against Payward's security baseline, during diligence where deal timelines allow and immediately post-close otherwise

Map the acquired company's existing controls to Payward's control framework, and identify gaps against the external frameworks the entity falls under once in scope

Score control maturity at the entity level and document the basis for each score

Define remediation milestones that are achievable for the acquired team's size and maturity, sequenced by risk reduction rather than by framework order

Track milestones to closure and report status to Security GRC leadership and the M&A Technology Team Recommend the endpoint for each entity: full migration onto Payward platforms, or uplift to a maturity level the central program can absorb

Load acquired-entity risks into the enterprise risk register and keep them current

Prepare acquired entities for inclusion in external audit scope, including evidence collection and walkthrough support

Act as the Security GRC point of contact for acquired-entity leadership, finance, and internal audit

Maintain policy coverage for acquired entities, including building entity-specific policy libraries where the parent policy set does not apply cleanly

Feed recurring findings back into the diligence process, so later deals are assessed against known patterns

Document the onboarding process so that it is repeatable and not dependent on one person

What Will you DoTarget Assessment Review target security posture during diligence: control environment, identity and access management, infrastructure, third-party dependencies, and prior audit or examination history

Produce a written assessment of each target against the Payward security baseline, separating the risks that matter to the deal from those that matter to steady-state operations

Give the M&A Technology Team and deal sponsors a clear read on what integration will cost in control remediation terms

Control Mapping and Framework Onboarding Map acquired controls to Payward's framework and to the external frameworks the entity becomes subject to Identify which parent-company controls extend to the entity as they are, which need an entity-specific variant, and which have no equivalent at all Build the entity's policy library where the parent policy set does not cover it Remediation and Milestones Set milestones the acquired team can meet, each with a date, an owner, and a stated risk reduction

Sequence work so that the highest-risk gaps close first rather than the easiest ones

Run the cadence for tracking remediation and escalating overdue or material risks Prepare proposed risk acceptances, including the rationale and…