Senior Security Engineer, Governance Risk and Compliance at CoinHako

<p style="min-height:1.5em">We are operating at the fast-moving frontier of the <strong>crypto</strong> ecosystem, where trust, speed, and ironclad security are paramount to our success. We aren't looking for a passive bureaucrat or a traditional checklist-checker. We need a sharp, highly autonomous <strong>Senior Engineer, GRC</strong> who genuinely loves the details, anticipates gaps before dashboards turn red, and possesses the human judgment to steer modern, tech-forward security frameworks. If you thrive in high-stakes environments and know how to balance real risk mitigation against empty paperwork, you’ll fit right in.</p><p style="min-height:1.5em"></p><p style="min-height:1.5em"><strong>What you'll be doing:</strong></p><ul style="min-height:1.5em"><li><p style="min-height:1.5em"><strong>Compliance lifecycle:</strong> Maintain ISO 27001 certification, prepare for SOC 2 Type 1 and 2, manage auditor relationships, and own evidence collection in Vanta. You know what's slipping before the dashboard turns red, and can forecast certification timelines confidently.</p></li><li><p style="min-height:1.5em"><strong>Vulnerability management (as a program):</strong> Own the SLA layer — weekly dashboard, breach escalation, exception tracking, and monthly leadership view. Engineers fix the bugs; you ensure they fix them on time.</p></li><li><p style="min-height:1.5em"><strong>Policy lifecycle:</strong> Annual reviews, new policies as scope expands, training rollout, attestation tracking, and exception requests. Reviews run through an adversarial AI pipeline today; you'll own the cadence and the human judgment inside it.</p></li><li><p style="min-height:1.5em"><strong>People-ops security controls:</strong> Onboarding/offboarding evidence, access reviews, security awareness training, background-check tracking, and permission groups. Partner with HR on the workflow; own the auditable artifact.</p></li><li><p style="min-height:1.5em"><strong>Vendor risk:</strong> Vendor inventory, pre-procurement assessments, and annual reassessments.</p></li><li><p style="min-height:1.5em"><strong>Risk program:</strong> Maintain the risk register and run quarterly reviews.</p></li><li><p style="min-height:1.5em"><strong>Data protection:</strong> DLP policy and tuning, data-classification programs, and PDPA partnership with Legal.</p></li><li><p style="min-height:1.5em"><strong>Business continuity:</strong> Own the BCP/DR program — documentation, drills, and post-exercise improvements.</p><p style="min-height:1.5em"></p></li></ul><p style="min-height:1.5em"><strong>What we're looking for:</strong></p><ul style="min-height:1.5em"><li><p style="min-height:1.5em">3–5 years in security or GRC program management, ideally at a fintech that grew through early stages.</p></li><li><p style="min-height:1.5em">Hands-on experience running ISO 27001 and SOC 2 audits end-to-end, including auditor management.</p></li><li><p style="min-height:1.5em">Deep fluency in <strong>Vanta</strong>