About Finix
Finix is building the global operating system for fintech, starting with payments. From startups to publicly traded companies, Finix processes tens of billions of dollars annually both in-store and online. Finix was founded in 2015 and is headquartered in San Francisco.
To date Finix has raised over $200M, including a $75M Series C led by Acrew Capital and Lightspeed Venture Partners and backed by American Express Ventures, Bain Capital Ventures, Homebrew, Inspired Capital, Visa, and others
About the role
The Information Security organization at Finix protects our platform, our customers, and the data they trust us with. As a Compliance Program Manager, you will own Finix’s compliance program end to end, from audit planning and control design to evidence collection and remediation. You will work closely with Engineering, Information Security, Legal, and IT.
You Will:
Own Finix’s PCI DSS program as a Level 1 service provider, including scoping, the annual ROC and AOC, and ongoing compliance between assessments
Own the SOC 2 Type II program, including audit planning, control design, and the annual report
Manage relationships with QSAs and external auditors, and lead audit fieldwork from kickoff through final report
Partner with control owners across teams to collect evidence, test controls, and drive remediation of findings
Maintain policies, procedures, and the control framework mapped across PCI DSS, SOC 2, and other regulatory requirements
Run risk assessments, third-party vendor risk reviews, BCP/DR etc
Respond to customer security questionnaires, partner due diligence requests, and compliance attestation requests
Track compliance metrics and report program status and risks to leadership
Build and improve compliance processes as Finix scales into new products and markets
You Have:
5+ years in compliance, audit, or GRC in payments or fintech
PCI DSS experience as a service provider, including ROC assessments with a QSA
Hands-on SOC 2 experience, including owning or supporting Type II audits
Experience working with external auditors, or working as an external auditor or QSA
Clear written and verbal communication, including presenting audit results and risks to technical and non-technical audiences
Experience with GRC platforms such as Drata or Vanta
General technical background and comfort discussing systems, infrastructure, and security controls with engineers
Nice to Have:
Working knowledge of cloud infrastructure, especially AWS
Internal audit experience
Certifications such as CISA, PCI ISA, PCI QSA, or CISSP
