← All roles

Sr. Security Engineer - GRC APAC Fintech & Financial Services

xAI· Information Security
Apply on company site
Tokyofull-timePosted 1w ago

About the role

Governance, Risk, and Compliance (GRC) Engineer focused on Japanese information security and financial services regulation to scale compliance for SpaceXSI and X Money in Tokyo, Japan. Responsible for Compliance-as-Code, continuous evidence collection, and embedding regulatory controls into engineering and CI/CD while partnering with Legal, Privacy, and external auditors.

Responsibilities

  • Own and evolve Japan financial services and payments compliance posture across JFSA supervisory expectations (including technology risk management, incident reporting, and third-party technology risk), APPI, and local Japanese banking and payments technology controls supporting X Money.
  • Build and maintain Compliance-as-Code capabilities — policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD.
  • Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance; integrate with cloud, identity, logging, and engineering systems to reduce administrative bottlenecks.
  • Partner with Architects and Engineering Leads to bake JFSA and APPI requirements into design early; translate complex regulatory obligations into concrete technical implementations and auditor-ready narratives.
  • Design, implement, and validate technical controls relevant to Japanese banking and payments environments (access control, logging and monitoring, encryption, change management, vulnerability management, BCDR, secure SDLC).
  • Operate the cybersecurity and compliance risk register — identify, quantify, and track risks and distinguish regulatory risk from theoretical gaps.
  • Lead risk assessments and compliance reviews for new products, payment flows, vendors, and architectural changes affecting the Japan regulated surface, including third-party risk.
  • Liaise with Legal and Data Privacy on APPI intersections and security measures for personal data and incident reporting per JFSA expectations.
  • Own and cultivate relationships with external auditors, assessors, and JFSA contacts; facilitate reasonable, clear requests between external parties and internal teams.
  • Develop, maintain, and improve policies, standards, and procedures aligned to JFSA, APPI, and local banking/payments requirements, mapped to a shared control library across jurisdictions.
  • Champion pragmatic governance — focus on real security or business risk over checkbox compliance.

Qualifications

  • Bachelor’s degree in computer science, Information Security, Cybersecurity, risk management, or engineering/STEM field, or equivalent practical experience.
  • 8+ years of experience owning or operating a GRC, information security compliance, or ISMS program in fintech, banking, payments, SaaS, or other regulated tech with primary Japan exposure.
  • Experience owning or materially operating an ISMS and control library; supporting client security assurance, external audits, or regulatory evidence processes.
  • Hands-on experience with JFSA supervisory expectations and local Japanese banking/payments controls, including implementing or operating controls.
  • Strong understanding of information security risk management, control assessment, risk treatment, and governance reporting to senior stakeholders.
  • Experience coordinating security incident response governance and third-party security assurance.
  • Working knowledge of APPI and collaboration with Privacy teams on security of personal data and incident support.
  • Technical fluency to partner with Engineering on cloud (AWS/GCP/Azure), identity, logging, and secure SDLC; evaluate control objectives against real configurations.

Skills

Required:GRC ownershipJFSA and APPI knowledgeCompliance-as-CodeCloud security & DevSecOpsRisk management & governance reportingVendor and third-party risk

Benefits

  • Not explicitly listed in the description.
Last updated Oct 21, 2026. Interested? Apply on the company site.

About xAI

liquid-ai-recruiting-target
Company profileWebsite

More open roles at xAI