Sr. Security Engineer, GRC APAC Fintech & Financial Services

xAI, Japan

The role

We are seeking an experienced Governance, Risk, and Compliance (GRC) Engineer focused on Japanese information security and financial services regulation to help scale compliance for SpaceXSI and X Money in Tokyo, Japan. As we expand deeper into the regulated Japanese market, maintaining a robust, transparent, and technically sound information security GRC program is critical. You will architect the systems and processes that automate trust — a pragmatic operator who understands that GRC exists to enable the business, balancing rigorous standards with the velocity of a high-growth company.

What you will do

Own and evolve Japan financial services and payments compliance posture across JFSA supervisory expectations (including technology risk management, incident reporting, and third-party technology risk), APPI, and local Japanese banking and payments technology controls supporting X Money
Build and maintain Compliance-as-Code capabilities — policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD — so audit and supervisory readiness scales with the business rather than depending on manual, point-in-time checks
Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance; integrate with cloud, identity, logging, and engineering systems to reduce administrative bottlenecks
Partner with Architects and Engineering Leads to bake JFSA and APPI requirements into design early; translate complex Japanese regulatory obligations into concrete technical implementations and auditor- or supervisor-ready narratives without slowing development
Design, implement, and validate technical controls relevant to Japanese banking and payments environments (access control, logging and monitoring, encryption, change management, vulnerability management, business continuity and disaster recovery, and secure SDLC) — not just document them
Operate the cybersecurity and compliance risk register — identify, quantify, and track risks, distinguishing theoretical gaps from meaningful business and regulatory risk under JFSA supervisory expectations
Lead risk assessments and compliance reviews for new products, payment flows, features, vendors, and architectural changes that affect the Japan regulated attack surface, including third-party technology risk and subcontractor/sub-processor oversight
Liaise with Legal and the Data Privacy team on security-relevant intersections with APPI, including security measures for personal data and breach/incident reporting aligned to applicable JFSA expectations
Own and cultivate relationships with external auditors, assessors, and (where applicable) JFSA supervisory contacts; serve as the bridge between external parties and internal teams so requests are reasonable, clear, and relevant to our stack
Develop, maintain, and continuously improve policies, standards, and procedures aligned to JFSA, APPI, and local banking and payments technology requirements, mapped to the control library shared with US Fintech to avoid duplicate control sets
Champion pragmatic governance – prioritize issues that represent real security or business risk over checkbox compliance

Nice to have

Demonstrable experience owning or materially operating an ISMS and control library, and experience supporting client security assurance, external audits, or regulatory evidence processes
Hands-on experience with JFSA supervisory expectations and local Japanese banking and payments technology controls — including implementing or operating controls, not only reading the requirements
Strong understanding of information security risk management, control assessment, risk treatment, and governance reporting to senior stakeholders
Experience coordinating security incident response governance (escalation, communications, remediation tracking) and operating or improving supplier/third-party security assurance
Working knowledge of APPI sufficient to partner with Privacy counterparts on security of personal data and incident support
Technical fluency to partner with Engineering on cloud (AWS/GCP/Azure), identity, logging, and secure SDLC — and to evaluate control objectives against real configurations
10+ years of information security compliance, GRC engineering, or technology audit experience in fintech or financial services with a primary Japan focus
Experience in a SaaS, fintech, financial services, regulated technology, or B2B enterprise software environment
Hands-on experience implementing technical controls (IAM, logging/monitoring, encryption, hardening) and integrating compliance checks into CI/CD / DevSecOps pipelines
Familiarity with secure SDLC practices: threat modeling, SAST/DAST, dependency scanning, secrets management, application/API penetration testing, and vulnerability remediation tracking
Deep familiarity with JFSA expectations for technology risk management, third-party technology risk, and incident reporting at banking and payments providers
Experience enabling enterprise sales through trust centers, vendor questionnaires, client audits, and contractual security schedules for clients in Japan
Experience mapping a single control library shared across jurisdictions (e.g., US Fintech and Japan) so JFSA, APPI, and local banking and payments technology requirements are met without duplicate control sets
Experience supporting BC/DR and resilience evidence (dependency mapping, backup/restore testing, RTO/RPO validation)
Proven ability to operate a risk register and apply judgment in gray areas — focusing on outcomes over optics
Excellent communication and stakeholder management — able to explain risk and tradeoffs to engineers, legal, privacy, sales, and executives in plain language
Certifications such as CISSP, CISM, CISA, CRISC, or equivalent
Prior experience working with or within JFSA-supervised financial institutions, banking or payments providers, or supervised fintechs in Japan
Japanese language proficiency a plus

Sr. Security Engineer, GRC APAC Fintech & Financial Services

The role

Sr. Security Engineer, GRC APAC Fintech & Financial Services

The role

What you will do

What you need

Basic qualifications

Additional requirements

Nice to have

About xAI

Similar jobs at other companies

Security Engineer

Security Engineer

Sr. Security Engineer

Security Engineer (Software)

Sr. Security Engineer (Infrastructure)

Forward Deployed Engineer - Japan

Company facts

Interview questions

xAI