{"id":4178770,"url":"https://alion.io/job/kraken-security-grc-analyst-mergers-acquisitions","title":"Security GRC Analyst, Mergers & Acquisitions","company":{"id":963,"name":"Kraken","domain":"kraken.com","url":"https://alion.io/company/kraken","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":91,"open_postings":7,"ghost_share":0,"stale_share":0.286,"repost_share":0.143,"time_to_fill_p50_days":42,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":83400,"max":166800,"currency":"USD","period":"year","gross":null,"usd_annual":166800},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-11-12T14:46:38Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T16:53:25Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Building the Future of Open Finance\nPayward - the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks - has spent the last 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system.\nThe team\nFounded in 2011, Kraken is one of the world's longest-standing crypto platforms, trusted by over 10 million individuals and institutions across the globe. It offers spot trading, margin, futures, staking, and OTC services, with products built for both individual investors and institutional clients.\nWe are looking for a Security GRC Lead to own security governance, risk, and compliance across Payward's acquisitions. You will be the accountable owner for bringing each acquired company from its own control environment into ours, working with the M&A Technology Team from diligence through to either full platform migration or steady-state coverage under our central program.\nPayward acquires and integrates companies continuously, across multiple jurisdictions and regulatory regimes. Every target arrives with its own controls, its own maturity level and its own audit history, and every one enters our financial statement audit scope on a timeline set by the deal rather than by readiness. Today that work competes for the same people who run controls for the parent company. This role exists so that it has a dedicated owner.\nThis is a build role to uphold the repeatable process for assessing an acquired company against our security baseline, mapping its controls into our compliance frameworks,and setting remediation milestones a newly acquired team can realistically hit. You will then run it, deal after deal, and you are accountable for the work getting done.\nThe opportunity\nAssess each acquisition target against Payward's security baseline, during diligence where deal timelines allow and immediately post-close otherwise\n\nMap the acquired company's existing controls to Payward's control framework, and identify gaps against the external frameworks the entity falls under once in scope\n\nScore control maturity at the entity level and document the basis for each score\n\nDefine remediation milestones that are achievable for the acquired team's size and maturity, sequenced by risk reduction rather than by framework order\n\nTrack milestones to closure and report status to Security GRC leadership and the M&A Technology Team\n\nRecommend the endpoint for each entity: full migration onto Payward platforms, or uplift to a maturity level the central program can absorb\n\nLoad acquired-entity risks into the enterprise risk register and keep them current\n\nPrepare acquired entities for inclusion in external audit scope, including evidence collection and walkthrough support\n\nAct as the Security GRC point of contact for acquired-entity leadership, finance, and internal audit\n\nMaintain policy coverage for acquired entities, including building entity-specific policy libraries where the parent policy set does not apply cleanly\n\nFeed recurring findings back into the diligence process, so later deals are assessed against known patterns\n\nDocument the onboarding process so that it is repeatable and not dependent on one person\n\nWhat Will you Do\nTarget Assessment\nReview target security posture during diligence: control environment, identity and access management, infrastructure, third-party dependencies, and prior audit or examination history\n\nProduce a written assessment of each target against the Payward security baseline, separating the risks that matter to the deal from those that matter to steady-state operations\n\nGive the M&A Technology Team and deal sponsors a clear read on what integration will cost in control remediation terms\n\nControl Mapping and Framework Onboarding\nMap acquired controls to Payward's framework and to the external frameworks the entity becomes subject to\n\nIdentify which parent-company controls extend to the entity as they are, which need an entity-specific variant, and which have no equivalent at all\n\nBuild the entity's policy library where the parent policy set does not cover it\n\nRemediation and Milestones\nSet milestones the acquired team can meet, each with a date, an owner, and a stated risk reduction\n\nSequence work so that the highest-risk gaps close first rather than the easiest ones\n\nRun the cadence for tracking remediation and escalating overdue or material risks Prepare proposed risk acceptances, including the rationale and compensating controls, and present them to leadership for decision\n\nProgram Integration\nPrepare entities for external audit inclusion and support fieldwork\n\nKeep acquired-entity risk visible in the enterprise risk register and in Security GRC reporting\n\nHand each entity over to central GRC coverage once its maturity supports it, with the handover documented\n\nIntegrate 3rd parties and vendors into Payward\n\nWhat you bring\n5-7+ years in security governance, IT risk, or compliance, including regulated financial services, fintech, or virtual asset environments\n\nDirect experience onboarding an acquired company into an existing controls or compliance program. This is the core of the role\n\nWorking knowledge of SOX/ICFR IT general controls and what external auditors accept as evidence\n\nExperience with at least two of ISO 27001, SOC 1, SOC 2, and PCI DSS, including mapping controls across frameworks\n\nAbility to assess control maturity and set remediation plans the receiving team completes, including teams below Payward's maturity level\n\nHands-on delivery: you write the scope, collect the evidence, and close gaps yourself when needed\n\nSound judgment on priorities with incomplete information, and the sense to escalate decisions that need leadership\n\nAbility to build working relationships with control owners in IAM, infrastructure, and engineering\n\nAbility to translate control gaps into risk language that deal teams and executives can act on\n\nStrong project management across cross-functional, distributed teams\n\nPreferred\nCISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer\n\nM&A or post-merger technology integration experience\n\nFamiliarity with PKM\n\nWhy This Role\nYou will own a domain end to end rather than supporting someone else's. There is no incumbent process and no one else doing this work today\n\nAcquisitions are one of the fastest-moving parts of the business, and security integration sits on the critical path for each one\n\nYou will work directly with deal teams, acquired-company leadership, external auditors, and Security GRC leadership, with visibility into how acquisitions are evaluated and closed\n\nPayward is preparing for public company reporting, which means the controls you put in place at acquired entities are the ones external auditors will test\n\nThe scope of this role grows with the acquisition pipeline, across jurisdictions and regulatory regimes\n\nYou will join a remote-first, international team\n\nUnless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis.\nPlease note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution.\nWe consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance.\nOur commitment\nPayward is powered by people from around the world and we celebrate the diverse talents, backgrounds, contributions, and unique perspectives that everyone brings to the table. We hire based on merit, seeking out people with the right abilities, knowledge, and skills for the job. We encourage you to apply for roles where you don't fully meet the listed requirements, especially if you're passionate or knowledgeable about crypto.\nWe may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision.\nAs an equal opportunity employer, we don't tolerate discrimination or harassment of any kind, whether based on race, ethnicity, age, gender identity, citizenship, religion, sexual orientation, disability, pregnancy, veteran status, or any other protected characteristic as outlined by federal, state, or local laws.\nStay connected\nFollow us on X\nLearn on the Kraken Blog\nConnect on LinkedIn\n Candidate Privacy Notice","description_format":"text","description_chars":8708,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cryptocurrencies","Crypto Exchanges","Mining & Staking","Online Brokerage & Trading Platforms"],"lifecycle":[{"event":"open","at":"2026-11-12T16:53:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":42,"reasons":["conf:1","win:early"],"computed_at":"2026-11-12T18:13:03Z"},"pay":{"stated_usd_annual":166800,"is_top_pay":true},"html_url":"https://alion.io/job/kraken-security-grc-analyst-mergers-acquisitions","json_url":"https://alion.io/job/kraken-security-grc-analyst-mergers-acquisitions.json","meta":{"generated_at":"2026-11-12T18:13:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":38294,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":963},"rest":"https://alion.io/mcp/rest/get_company?id=963"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkraken-security-grc-analyst-mergers-acquisitions"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkraken-security-grc-analyst-mergers-acquisitions"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkraken-security-grc-analyst-mergers-acquisitions"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kraken-security-grc-analyst-mergers-acquisitions\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkraken-security-grc-analyst-mergers-acquisitions"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4178770}},{"tool":"search_jobs","arguments":{"company":"kraken.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4178770},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}