Sr. Security Engineer (GRC APAC Fintech & Financial Services)

Location: Tokyo, Japan; based in Japan

Company

xAI develops AI systems designed to understand the universe and support humanity’s pursuit of knowledge, including regulated financial services initiatives.

What you will do

• Own and evolve Japan financial services and payments compliance across JFSA supervisory expectations, APPI, and local banking technology controls.
• Build compliance-as-code capabilities, including policy-as-code, automated control validation, continuous evidence collection, and CI/CD monitoring.
• Operate GRC platforms such as Vanta and integrate them with cloud, identity, logging, and engineering systems.
• Partner with architects and engineering leads to implement access control, logging, encryption, change management, vulnerability management, BC/DR, and secure SDLC controls.
• Lead risk assessments and compliance reviews for products, payment flows, vendors, architectural changes, and third-party technology risks.
• Manage relationships with auditors, assessors, Legal, Privacy, and applicable JFSA supervisory contacts.

Requirements

• Bachelor’s degree in computer science, information security, cybersecurity, risk management, engineering, or equivalent practical experience.
• 8+ years of experience operating GRC, information security compliance, or ISMS programs in fintech, banking, payments, SaaS, or regulated technology environments, with primary Japan exposure.
• Hands-on experience with JFSA supervisory expectations, APPI, Japanese banking and payments technology controls, control libraries, audits, and regulatory evidence.
• Strong information security risk management, control assessment, risk treatment, governance reporting, incident response governance, and supplier security assurance experience.
• Technical fluency with cloud platforms, identity, logging, secure SDLC, and evaluating controls against real configurations.
• Fluent English is required; the role is based in Japan.

Nice to have

• 10+ years of information security compliance, GRC engineering, or technology audit experience in Japanese fintech or financial services.
• Experience with IAM, logging and monitoring, encryption, hardening, threat modeling, SAST/DAST, dependency scanning, secrets management, and penetration testing.
• Experience with BC/DR evidence, dependency mapping, backup and restore testing, and RTO/RPO validation.
• CISSP, CISM, CISA, CRISC, or equivalent certification.
• Japanese language proficiency and prior experience with JFSA-supervised institutions.

Culture & Benefits

• Small, highly motivated organization focused on engineering excellence and curiosity.
• Flat structure with hands-on contribution expected from all employees.
• Pragmatic governance focused on meaningful security and business risk rather than checkbox compliance.
• Occasional travel may be required.