Security GRC Analyst, Mergers & Acquisitions

Location: Remote; listed locations include the United Kingdom, Brazil, United Arab Emirates, Ireland, Peru, Sweden, Colombia, Argentina, Romania, Cyprus, Switzerland, Portugal, Lithuania, South Africa, Czech Republic, Canada, Hungary, Mexico, Chile, Poland, Spain, and Bulgaria.

Company

hirify.global is a global crypto platform offering trading, staking, futures, OTC, and financial infrastructure products through Payward.

What you will do

• Assess acquisition targets during diligence or immediately post-close across controls, IAM, infrastructure, third-party dependencies, and audit history.
• Map acquired controls to Payward’s security and compliance frameworks, identify gaps, and build entity-specific policy libraries where needed.
• Set risk-based remediation milestones with owners and dates, track closure, escalate overdue or material risks, and prepare proposed risk acceptances.
• Prepare acquired entities for external audit scope, including evidence collection, walkthrough support, and fieldwork.
• Maintain acquired-entity risks in the enterprise risk register and Security GRC reporting.
• Document the onboarding and handover process, integrate third parties and vendors, and feed recurring findings into future diligence.

Requirements

• 5–7+ years in security governance, IT risk, or compliance, including regulated financial services, fintech, or virtual asset environments.
• Direct experience onboarding an acquired company into an existing controls or compliance program.
• Working knowledge of SOX/ICFR IT general controls and evidence accepted by external auditors.
• Experience with at least two of ISO 27001, SOC 1, SOC 2, and PCI DSS, including cross-framework control mapping.
• Ability to assess control maturity, create achievable remediation plans, and complete hands-on evidence collection and gap closure.
• Sound prioritization and escalation judgment with incomplete information.
• Ability to build relationships with IAM, infrastructure, and engineering control owners and translate gaps into actionable risk language.
• Strong project management across cross-functional, distributed teams.

Nice to have

• CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer.
• M&A or post-merger technology integration experience.
• Familiarity with PKM.

Culture & Benefits

• Remote-first, international team.
• Direct ownership of a new security integration domain across acquisitions and jurisdictions.
• Direct collaboration with deal teams, acquired-company leadership, external auditors, and Security GRC leadership.
• Applications are accepted on an ongoing basis unless a deadline is specified.
• Qualified applicants may redact age, date of birth, and education attendance or graduation dates from resumes.
• Job-related skills or work-style assessments may be part of the hiring process.