Security Engineer, GRC Fintech & Financial Services

xAI, New York, NY +2

The role

We are seeking an experienced Governance, Risk, and Compliance (GRC) Engineer focused on fintech and financial services regulation to help scale compliance for SpaceXSI and X Money. As we operate deeper in regulated financial environments, maintaining a robust, transparent, and technically sound GRC program is critical. You will architect the systems and processes that automate trust — a pragmatic operator who understands that GRC exists to enable the business, balancing rigorous standards with the velocity of a high-growth company.

Posted pay

$100K–$198K

a year

Compared with similar jobs

This base pay is below the median for security engineering jobs in the Bay Area with no level in the job title.

Median: $211K a year
Other jobs in the group: 237

We compare the middle of each posted range. This is base pay as posted. The group does not include this job.

Location

New York, NY +2

Work type

Not given

Level

Not given

Experience

3+ years

Skills in the job text

Posted

Jul 29, 2026

Last check

11 min ago

Job type

Security engineering

The role

What you will do

Own and evolve financial services and payments compliance posture across PCI DSS, NYDFS (including 23 NYCRR 500), FFIEC guidance, and related banking/fintech regulatory expectations supporting X Money across relevant jurisdictions
Build and maintain Compliance-as-Code capabilities — policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD — so audit readiness scales with the business rather than depending on manual, point-in-time checks
Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance; integrate with cloud, identity, logging, and engineering systems to reduce administrative bottlenecks
Partner with Architects and Engineering Leads to bake compliance and privacy requirements; translate complex regulatory obligations into concrete technical implementations and auditor-ready narratives without slowing development
Design, implement, and validate technical controls relevant to fintech environments (cardholder data environment scoping and segmentation, access control, logging, encryption, change management, vulnerability management) — not just document them
Operate the cybersecurity and compliance risk register — identify, quantify, and track risks, distinguishing theoretical gaps from meaningful business and regulatory risk
Lead risk assessments and compliance reviews for new products, payment flows, features, vendors, and architectural changes that affect the regulated attack surface
Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; serve as the bridge between auditors and internal teams so requests are reasonable, clear, and relevant to our stack
Develop, maintain, and continuously improve policies, standards, and procedures aligned to PCI, NYDFS, FFIEC, privacy laws, and complementary frameworks (e.g., SOC 2, ISO 27001) where they overlap
Champion pragmatic governance – prioritize issues that represent real security or business risk over checkbox compliance

Nice to have

Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, or similar), with a bias toward continuous monitoring and reducing manual evidence collection
Technical fluency sufficient to speak the language of engineering, cloud (AWS/GCP/Azure), and security architecture, and to anticipate how design decisions impact risk and compliance
Experience with security compliance, GRC engineering, or technology audit-related experience in fintech or financial services
Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, network segmentation, infrastructure hardening) and integrating compliance checks into CI/CD pipelines
Experience supporting SOC 2 and/or ISO 27001 programs alongside fintech-specific obligations
Experience with payment ecosystems, cardholder data environments, tokenization, or similar PCI-scoped architectures
Working knowledge of data privacy frameworks including GDPR and CCPA/CPRA, and experience partnering with Legal or Privacy
Familiarity with additional financial regulatory regimes (e.g., GLBA, BSA/AML technology controls, state money-transmitter expectations, or international banking rules in the EU, UK, or other markets, e.g DORA) is valuable
Experience enabling enterprise sales through trust centers, vendor questionnaires, and customer security reviews
Proven ability to operate a risk register and apply judgment in gray areas — focusing on outcomes over optics
Exceptional analytical, problem-solving, organizational, and project management skills, with the ability to take compliance programs from conception to assessment-ready launch
Excellent communication and stakeholder management skills — able to explain regulatory and privacy requirements to engineers, legal, sales, and executives in plain language
Certifications such as CISSP, CISA, CISM, CRISC, PCIP, CIPP/US, CIPP/E, or similar
Experience with emerging AI-related financial services expectations or securing AI features in a regulated fintech product

Security Engineer, GRC Fintech & Financial Services

The role

Security Engineer, GRC Fintech & Financial Services

The role

What you will do

What you need

Basic qualifications

Additional requirements

Itar requirements

Nice to have

Pay and benefits

About xAI

Similar jobs at other companies

Security Engineer

Security Engineer

Security Engineer (Software)

Security GRC Engineer

Security Engineer (Infrastructure)

Sr. Software Engineer, Security (Starship)

Company facts

Interview questions

xAI

Compared with similar jobs