Head of Security & Technology Risk

CURRENT STATE
Today, nearly every high-level security decision at this well-established wealth management firm runs through one person: the CTO. As the firm scales its data, AI, and cloud initiatives and the CTO's responsibilities broaden, that has become a bottleneck, and a single point of failure when a call is time-sensitive.

THE VISION
Leadership is standing up a new Office of the CTO: three peer seats replacing a siloed IT department. Head of Data & Analytics, Head of Business Systems, and this role. This is a new seat, not a backfill, and the CTO is transferring real decision-making authority to it.

THE GAP
No one owns security and risk end-to-end and can move at the speed the business needs. Most security leaders default to "no." This firm needs someone who understands the technology well enough to engineer the path to "yes."

What You'll Do

• Own security architecture, governance, and risk decisions firmwide, including approving exceptions without escalating

• Sit in on architecture and design sessions, whiteboard data flows, evaluate security tooling, and hand designs to engineers to build

• Partner with Data & Analytics and Business Systems to enable AI/ML and data initiatives safely. That includes questions like how to let non-technical users build code without creating risk.

• Be the senior security voice in the room during incidents: manage the MSSP and communicate directly with partners and the CEO

• Evolve the existing governance framework ahead of the business, so initiatives don't stall

• Advise across infrastructure, DevOps, and third-party apps as a hands-on generalist, pulling resources from across IT per project

What Makes This Unique

• Real authority, not an advisory title. You're taking over the CTO's security decision-making.

• Small, low-ego leadership team with direct access to partners and the CEO

• AI-heavy agenda from day one, in a firm that values people who tinker

• Everybody does everything here. You'll learn the business and weigh in beyond security.

Who You Are

• Hands-on security engineering or architecture background, now senior (small-shop CISO, deputy CISO, or head of security architecture)

• Still close to the technology: home lab, scripts, trying new tools, not just reading summaries

• Executive presence: concise, confident, and trusted by senior stakeholders

• Experience through the containerization and cloud waves, with real curiosity about AI and agentic risk

• A "yes, and here's how" mindset, with a bias toward architecture over policy

What This Is NOT

• Not a SOC, incident response, or infrastructure hardening role

• Not a GRC or paperwork function

• Not a role where certifications outweigh judgment (CISSP/CISM/CRISC preferred, not required)

• Not a traditional team-leadership role. No direct reports at launch, so this is matrixed and player-coach.

• Not an immediate stepping stone to CTO