[Hiring] Chief Information Security Officer @Titan

Role Description

As RFA's CISO, you own security for RFA and its clients. You lead RFA's GRC, SOC, and vCISO teams, act as the senior security advisor to client leadership, and make sure RFA itself holds up to the scrutiny of the most demanding funds. You'll report to RFA's COO and work closely with RFA's service delivery and engineering teams, and with Titan's product and engineering teams.

You own and measure success by client outcomes (incidents prevented and contained, audits and DDQs passed), growth and retention of RFA's security revenue, and an RFA that passes every client security review.

This role is remote (US).

In this role you will:

• Set RFA's security strategy and lead RFA's GRC, SOC, and vCISO teams, who report to you.
• Build and run RFA's client security offering: vCISO, managed detection and response, SOC, vulnerability management, email security, and incident response, with AI agents doing the volume and people doing the judgment.
• Be the trusted security advisor to client CFOs, COOs, and CCOs: board and investment committee updates, regulatory readiness (SEC, FINRA, Reg S-P, state privacy rules), and investor DDQs.
• Lead incident response for RFA clients, from first alert to client communication and lessons learned.
• Own RFA's own security and compliance program, including SOC 2 and the security questionnaires clients send us.
• Work with Titan's engineers to make sure the AI agents working in client environments are safe: least-privilege access, guardrails, logging, and audit trails.
• Guide RFA clients adopting Claude, ChatGPT, and Copilot on AI governance: data boundaries, connector and permission review, shadow AI discovery.
• Join sales cycles as RFA's security voice: win the client's CISO or CCO, and turn what we learn into packaged services and pricing.

Qualifications

• 10+ years in security, including leading a security function or practice as CISO, VP, or Head of Security.
• Experience building or running security services at an MSP, MSSP, or security consultancy, ideally serving financial services firms.
• Knowledge of what hedge funds, PE firms, and asset managers need from security: SEC cybersecurity rules, Reg S-P, investor DDQs, and frameworks like NIST CSF, SOC 2, and ISO 27001.
• Hands-on experience with Microsoft 365, Entra ID, Intune, Defender, and modern EDR, SIEM, and email security stacks.
• Excitement about AI agents doing security work, with opinions on how to make them safe.
• Ability to explain risk to a fund COO in plain language and to an engineer in technical detail.
• Extreme ownership mentality, preferring to build the program rather than inherit one.

Requirements

• CISSP, CISM, CISA, or CRISC (bonus).
• vCISO experience across multiple financial services clients (bonus).
• Experience securing LLM applications or AI governance work (e.g., ISO/IEC 42001, NIST AI RMF) (bonus).

Logistics

• Location: Remote (US).
• Travel: Under 5%, for occasional client meetings and time with the team in NYC.